Overview

overview

10

Static

static

10

15ef542282...6b.exe

windows7_x64

10

15ef542282...6b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    15ef5422825d3b45ed50794220abc8e0798d824f2fba14ad57a448edf49f406b

  • Size

    216KB

  • Sample

    220212-eqfjfsfgh3

  • MD5

    5b7fda1ae44b2d18a163c9234ccaf384

  • SHA1

    7e2660ca1f9fc5660455a6ffe98715de50962f1c

  • SHA256

    15ef5422825d3b45ed50794220abc8e0798d824f2fba14ad57a448edf49f406b

  • SHA512

    7492ade5103bf205a55d9672f36edf6f05f6915342ff24983f1d182d071ae52f1a40e4675248d67a9b8ff144e7f2c6745a9c82e291f9001a9f06d04b60966547

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      15ef5422825d3b45ed50794220abc8e0798d824f2fba14ad57a448edf49f406b

    • Size

      216KB

    • MD5

      5b7fda1ae44b2d18a163c9234ccaf384

    • SHA1

      7e2660ca1f9fc5660455a6ffe98715de50962f1c

    • SHA256

      15ef5422825d3b45ed50794220abc8e0798d824f2fba14ad57a448edf49f406b

    • SHA512

      7492ade5103bf205a55d9672f36edf6f05f6915342ff24983f1d182d071ae52f1a40e4675248d67a9b8ff144e7f2c6745a9c82e291f9001a9f06d04b60966547

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks