Overview

overview

10

Static

static

10

15c29b2ed9...ac.exe

windows7_x64

10

15c29b2ed9...ac.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    15c29b2ed9336980facd7d5a413f32d205290b5735ba94c7931389bb6f9300ac

  • Size

    216KB

  • Sample

    220212-etqhtsfhc5

  • MD5

    8eff952ce23c133b077709b1fdddc38f

  • SHA1

    a3bb5ce31de362867bf44054fe2301fb0f4181be

  • SHA256

    15c29b2ed9336980facd7d5a413f32d205290b5735ba94c7931389bb6f9300ac

  • SHA512

    215f17d83ba9af99f6d8f004a71b82260f00cec0c9d4ea6d4ee19455850c140f7dbdc0bec5f23bab6d53fd07180fe51b096c848552ecb9cdfe7d4ceee5f3bfd3

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      15c29b2ed9336980facd7d5a413f32d205290b5735ba94c7931389bb6f9300ac

    • Size

      216KB

    • MD5

      8eff952ce23c133b077709b1fdddc38f

    • SHA1

      a3bb5ce31de362867bf44054fe2301fb0f4181be

    • SHA256

      15c29b2ed9336980facd7d5a413f32d205290b5735ba94c7931389bb6f9300ac

    • SHA512

      215f17d83ba9af99f6d8f004a71b82260f00cec0c9d4ea6d4ee19455850c140f7dbdc0bec5f23bab6d53fd07180fe51b096c848552ecb9cdfe7d4ceee5f3bfd3

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks