Overview

overview

10

Static

static

15a036d775...5a.exe

windows7_x64

10

15a036d775...5a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    15a036d77514c6fd47ea891166a3c7efbba5a7e06eb1d0c54b0eb0f875ded15a

  • Size

    58KB

  • Sample

    220212-ewkelahdhk

  • MD5

    c551f52cdddb47d224cc89e71b914ff8

  • SHA1

    3f6ae3cc8e65f225d10bd843e309fcaad55076bb

  • SHA256

    15a036d77514c6fd47ea891166a3c7efbba5a7e06eb1d0c54b0eb0f875ded15a

  • SHA512

    f0399a067878b33d3f8ccae258f733343467152f7611f09db9bbbcd86133e0ed1e0e275ea9273a4405449285c996661354662a59b0cc4a81691eebfebd4af7ac

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      15a036d77514c6fd47ea891166a3c7efbba5a7e06eb1d0c54b0eb0f875ded15a

    • Size

      58KB

    • MD5

      c551f52cdddb47d224cc89e71b914ff8

    • SHA1

      3f6ae3cc8e65f225d10bd843e309fcaad55076bb

    • SHA256

      15a036d77514c6fd47ea891166a3c7efbba5a7e06eb1d0c54b0eb0f875ded15a

    • SHA512

      f0399a067878b33d3f8ccae258f733343467152f7611f09db9bbbcd86133e0ed1e0e275ea9273a4405449285c996661354662a59b0cc4a81691eebfebd4af7ac

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks