Overview

overview

10

Static

static

15749e6c5d...67.exe

windows7_x64

10

15749e6c5d...67.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    15749e6c5d482c1f9e3820530ccdff2b7c0e9e17260c79d2dcab212a3a019d67

  • Size

    60KB

  • Sample

    220212-eyy1rshebn

  • MD5

    70db31f61225d99e9901ad985c1f46ed

  • SHA1

    45e8bf27cdd07468007e4c8184a5c53abd61505b

  • SHA256

    15749e6c5d482c1f9e3820530ccdff2b7c0e9e17260c79d2dcab212a3a019d67

  • SHA512

    f23b49a77aa63c8518be499714f19f3fa543c68968e22dc064143857862c17e917f9205e61979e06b378fdb553cde519953ed2e5e8b0cb9e4235e742dc758a5a

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      15749e6c5d482c1f9e3820530ccdff2b7c0e9e17260c79d2dcab212a3a019d67

    • Size

      60KB

    • MD5

      70db31f61225d99e9901ad985c1f46ed

    • SHA1

      45e8bf27cdd07468007e4c8184a5c53abd61505b

    • SHA256

      15749e6c5d482c1f9e3820530ccdff2b7c0e9e17260c79d2dcab212a3a019d67

    • SHA512

      f23b49a77aa63c8518be499714f19f3fa543c68968e22dc064143857862c17e917f9205e61979e06b378fdb553cde519953ed2e5e8b0cb9e4235e742dc758a5a

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks