Overview

overview

10

Static

static

015c7151fa...f5.exe

windows7_x64

10

015c7151fa...f5.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    015c7151fa52e345776a6584ad1bdcc9ea12e6664dbe48baf35ef9ee8b8daef5

  • Size

    58KB

  • Sample

    220212-pn6mzacce2

  • MD5

    cc102950985995d4b7951cb58c9a83a4

  • SHA1

    7e1fe87b615ba185e7f9f878b8e027dcdcc5f32e

  • SHA256

    015c7151fa52e345776a6584ad1bdcc9ea12e6664dbe48baf35ef9ee8b8daef5

  • SHA512

    326f262a55b3dfe1390f81ca7dc809e4876e2ca580cb64cecd754c18a526be5a695e84c3a8babc340debe555d0344daf5317d19fda097344ca0c6ff200f82e62

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      015c7151fa52e345776a6584ad1bdcc9ea12e6664dbe48baf35ef9ee8b8daef5

    • Size

      58KB

    • MD5

      cc102950985995d4b7951cb58c9a83a4

    • SHA1

      7e1fe87b615ba185e7f9f878b8e027dcdcc5f32e

    • SHA256

      015c7151fa52e345776a6584ad1bdcc9ea12e6664dbe48baf35ef9ee8b8daef5

    • SHA512

      326f262a55b3dfe1390f81ca7dc809e4876e2ca580cb64cecd754c18a526be5a695e84c3a8babc340debe555d0344daf5317d19fda097344ca0c6ff200f82e62

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks