Overview

overview

10

Static

static

10

15af1eef06...36.exe

windows7_x64

10

15af1eef06...36.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    15af1eef06f2db43bb6f8db940de14ee452aa001dd7f5bd805e16e3496723036

  • Size

    79KB

  • Sample

    220212-evcy5ahdfp

  • MD5

    eec9e14eff77b6a87dc459515cd54077

  • SHA1

    774c5903c8846fc87fe2422a40c426a6f8ab528e

  • SHA256

    15af1eef06f2db43bb6f8db940de14ee452aa001dd7f5bd805e16e3496723036

  • SHA512

    7ba24356aa0ecf917af8ad45754ff99cdc32a00ae47d768ca40c2f94aa6da1a7a829e5d5fd86b5964822e3a6dd902a0a2a098a9e48b422bb2fc5f70bb7b4756f

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      15af1eef06f2db43bb6f8db940de14ee452aa001dd7f5bd805e16e3496723036

    • Size

      79KB

    • MD5

      eec9e14eff77b6a87dc459515cd54077

    • SHA1

      774c5903c8846fc87fe2422a40c426a6f8ab528e

    • SHA256

      15af1eef06f2db43bb6f8db940de14ee452aa001dd7f5bd805e16e3496723036

    • SHA512

      7ba24356aa0ecf917af8ad45754ff99cdc32a00ae47d768ca40c2f94aa6da1a7a829e5d5fd86b5964822e3a6dd902a0a2a098a9e48b422bb2fc5f70bb7b4756f

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks