Overview

overview

10

Static

static

10

122515ebd1...21.exe

windows7_x64

10

122515ebd1...21.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    122515ebd1e15a406f1fb8846de97ed0f9b50b6ca899bc0be5bc79e60153d621

  • Size

    150KB

  • Sample

    220212-gby4csgeg6

  • MD5

    ef3c1c7dfb74da44143bdf481fc76a07

  • SHA1

    e3596d59da66e94561c8ac364b659e56a4f12df7

  • SHA256

    122515ebd1e15a406f1fb8846de97ed0f9b50b6ca899bc0be5bc79e60153d621

  • SHA512

    2c37329ba5e6c85a7b6a569b228cdb754b04464c4fc6400105920bc73fd8d283e6a1563e51047e2d1fdb89b50fbbf0d1d4ac94eaa19bd5bc60ab3781abe48400

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      122515ebd1e15a406f1fb8846de97ed0f9b50b6ca899bc0be5bc79e60153d621

    • Size

      150KB

    • MD5

      ef3c1c7dfb74da44143bdf481fc76a07

    • SHA1

      e3596d59da66e94561c8ac364b659e56a4f12df7

    • SHA256

      122515ebd1e15a406f1fb8846de97ed0f9b50b6ca899bc0be5bc79e60153d621

    • SHA512

      2c37329ba5e6c85a7b6a569b228cdb754b04464c4fc6400105920bc73fd8d283e6a1563e51047e2d1fdb89b50fbbf0d1d4ac94eaa19bd5bc60ab3781abe48400

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks