Overview

overview

10

Static

static

156a4dafb4...1a.exe

windows7_x64

10

156a4dafb4...1a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    156a4dafb4b33175eefe05c6979470d92aa3849b9a86b7c42fadd16da043a81a

  • Size

    36KB

  • Sample

    220212-ezqqsaheck

  • MD5

    5df00aaf96deecf994db7fa262a1b83a

  • SHA1

    c2fec4a154d57dba7e28760f3b34892cec3a3370

  • SHA256

    156a4dafb4b33175eefe05c6979470d92aa3849b9a86b7c42fadd16da043a81a

  • SHA512

    b3918ed680956b6860eec52cdddf18792cfe111f065d263ac9c995f2102f75ba4da91f22e6f1a0bdae8af1458054b17fc4f507d6a847de0ba445f6692f3b9c61

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      156a4dafb4b33175eefe05c6979470d92aa3849b9a86b7c42fadd16da043a81a

    • Size

      36KB

    • MD5

      5df00aaf96deecf994db7fa262a1b83a

    • SHA1

      c2fec4a154d57dba7e28760f3b34892cec3a3370

    • SHA256

      156a4dafb4b33175eefe05c6979470d92aa3849b9a86b7c42fadd16da043a81a

    • SHA512

      b3918ed680956b6860eec52cdddf18792cfe111f065d263ac9c995f2102f75ba4da91f22e6f1a0bdae8af1458054b17fc4f507d6a847de0ba445f6692f3b9c61

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks