Overview

overview

10

Static

static

10

157f4afe86...7b.exe

windows7_x64

10

157f4afe86...7b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    157f4afe86bdede9def3bca7c27c018b8b2945214e2d288334902d73eee8a37b

  • Size

    150KB

  • Sample

    220212-ex7xaafhf8

  • MD5

    734bd525be7ec12f9b9191e4f1bf79e3

  • SHA1

    9101d9d2817a6791d7ce9feaf7d34508c6daaa42

  • SHA256

    157f4afe86bdede9def3bca7c27c018b8b2945214e2d288334902d73eee8a37b

  • SHA512

    a332474b9c401a9afcc759ea75d386f163146b55439d46208b302e55371e56fd87ae0a14db1de4a6c976806a79da54c76d1e373bd1c26998450f7d5ea5119d17

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      157f4afe86bdede9def3bca7c27c018b8b2945214e2d288334902d73eee8a37b

    • Size

      150KB

    • MD5

      734bd525be7ec12f9b9191e4f1bf79e3

    • SHA1

      9101d9d2817a6791d7ce9feaf7d34508c6daaa42

    • SHA256

      157f4afe86bdede9def3bca7c27c018b8b2945214e2d288334902d73eee8a37b

    • SHA512

      a332474b9c401a9afcc759ea75d386f163146b55439d46208b302e55371e56fd87ae0a14db1de4a6c976806a79da54c76d1e373bd1c26998450f7d5ea5119d17

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks