Overview

overview

10

Static

static

159b9eef8b...c4.exe

windows7_x64

10

159b9eef8b...c4.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    159b9eef8b529f676b27b13578bbfdf5b24ea9659aef861f4ff88f16ebf742c4

  • Size

    58KB

  • Sample

    220212-ewmjysfhe5

  • MD5

    fcfdc8f1721f7bc4eec116875c5641fb

  • SHA1

    bffa64cc0699cfa1c0670e938ca46a4de0bf53f3

  • SHA256

    159b9eef8b529f676b27b13578bbfdf5b24ea9659aef861f4ff88f16ebf742c4

  • SHA512

    27fef9e7b247475189613fc2de4f4b51b99ffbfe2bb3774127264d1f5c386cc5e10823998c118471541bfa19a84109730efc4c0ce8056773d325b949edacc7a2

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      159b9eef8b529f676b27b13578bbfdf5b24ea9659aef861f4ff88f16ebf742c4

    • Size

      58KB

    • MD5

      fcfdc8f1721f7bc4eec116875c5641fb

    • SHA1

      bffa64cc0699cfa1c0670e938ca46a4de0bf53f3

    • SHA256

      159b9eef8b529f676b27b13578bbfdf5b24ea9659aef861f4ff88f16ebf742c4

    • SHA512

      27fef9e7b247475189613fc2de4f4b51b99ffbfe2bb3774127264d1f5c386cc5e10823998c118471541bfa19a84109730efc4c0ce8056773d325b949edacc7a2

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks