Overview

overview

10

Static

static

15ad57ed05...ca.exe

windows7_x64

10

15ad57ed05...ca.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    15ad57ed054f3fab15cc5a39c747ced65e9d415d56fa06e227f56a534b0afdca

  • Size

    35KB

  • Sample

    220212-evgx3shdfr

  • MD5

    3cfea5ea315c64c940148d79831524e0

  • SHA1

    2d30609f8429ff98151a5dcf8ff2140854a820c7

  • SHA256

    15ad57ed054f3fab15cc5a39c747ced65e9d415d56fa06e227f56a534b0afdca

  • SHA512

    dd77f37b3365a22729b8287d46bf858a38138785af7dc523c4e823f5131e7ba096210feb3b733d924ef57b48f4f0f87033d928c6ee26cfca4a1d71c810667918

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      15ad57ed054f3fab15cc5a39c747ced65e9d415d56fa06e227f56a534b0afdca

    • Size

      35KB

    • MD5

      3cfea5ea315c64c940148d79831524e0

    • SHA1

      2d30609f8429ff98151a5dcf8ff2140854a820c7

    • SHA256

      15ad57ed054f3fab15cc5a39c747ced65e9d415d56fa06e227f56a534b0afdca

    • SHA512

      dd77f37b3365a22729b8287d46bf858a38138785af7dc523c4e823f5131e7ba096210feb3b733d924ef57b48f4f0f87033d928c6ee26cfca4a1d71c810667918

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks