Overview

overview

10

Static

static

10

1570205255...2d.exe

windows7_x64

10

1570205255...2d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    157020525540c7a08c86e8718085c289ed674d5c7b5854dee2ef25d3340b452d

  • Size

    150KB

  • Sample

    220212-ezadssfhh4

  • MD5

    fe907b8d26695d627708572272188444

  • SHA1

    06aa35a3069f52ef9d197d0750c5f43e20009162

  • SHA256

    157020525540c7a08c86e8718085c289ed674d5c7b5854dee2ef25d3340b452d

  • SHA512

    40b82b2d01cb484086e448f84bf8a890b4bfe04f01d758c8404d61efdca29c91d85efe1d3c301d5eaf008409ea027daebf8552f05b195822a2ba61d82fea7fc2

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      157020525540c7a08c86e8718085c289ed674d5c7b5854dee2ef25d3340b452d

    • Size

      150KB

    • MD5

      fe907b8d26695d627708572272188444

    • SHA1

      06aa35a3069f52ef9d197d0750c5f43e20009162

    • SHA256

      157020525540c7a08c86e8718085c289ed674d5c7b5854dee2ef25d3340b452d

    • SHA512

      40b82b2d01cb484086e448f84bf8a890b4bfe04f01d758c8404d61efdca29c91d85efe1d3c301d5eaf008409ea027daebf8552f05b195822a2ba61d82fea7fc2

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks