Overview

overview

10

Static

static

10

158a524650...01.exe

windows7_x64

10

158a524650...01.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    158a52465055d0341a1002774af978ca77a5287e8bf2f04bb8b7a4d2a72e3401

  • Size

    80KB

  • Sample

    220212-exaa1sfhf2

  • MD5

    baa957e90b1fed34bb0549a1ced98392

  • SHA1

    8385d115b3a13f63320a5b7f39bff8fd24ba2fcd

  • SHA256

    158a52465055d0341a1002774af978ca77a5287e8bf2f04bb8b7a4d2a72e3401

  • SHA512

    6dec4f1670096a195ca404fcad00d8dc28a502a581675b5ff39ca859ae39aa056fa22b74be001df59c56c878bf90e13dc1bdbfd6f97e9ffc727d09bc2cce603a

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      158a52465055d0341a1002774af978ca77a5287e8bf2f04bb8b7a4d2a72e3401

    • Size

      80KB

    • MD5

      baa957e90b1fed34bb0549a1ced98392

    • SHA1

      8385d115b3a13f63320a5b7f39bff8fd24ba2fcd

    • SHA256

      158a52465055d0341a1002774af978ca77a5287e8bf2f04bb8b7a4d2a72e3401

    • SHA512

      6dec4f1670096a195ca404fcad00d8dc28a502a581675b5ff39ca859ae39aa056fa22b74be001df59c56c878bf90e13dc1bdbfd6f97e9ffc727d09bc2cce603a

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks