Overview

overview

10

Static

static

0154ecc2f0...ff.exe

windows7_x64

10

0154ecc2f0...ff.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0154ecc2f0e3365a81bfb217b1541ace0e4e96b01e55a2248b9c12777f0cdcff

  • Size

    36KB

  • Sample

    220212-ppg11acce6

  • MD5

    5b7fb26cacb74527b1653a4c6e461793

  • SHA1

    85660cbeab8843618429f3f2075dca889ace680c

  • SHA256

    0154ecc2f0e3365a81bfb217b1541ace0e4e96b01e55a2248b9c12777f0cdcff

  • SHA512

    cca40ca3b2da96919a9ed64ef0ad23089258e8e0ef2921b2d0eedff22cfae071c22afac1b85029078bed123cdba31d7a5910620f3bb0a650cbc5d98eaf60787d

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0154ecc2f0e3365a81bfb217b1541ace0e4e96b01e55a2248b9c12777f0cdcff

    • Size

      36KB

    • MD5

      5b7fb26cacb74527b1653a4c6e461793

    • SHA1

      85660cbeab8843618429f3f2075dca889ace680c

    • SHA256

      0154ecc2f0e3365a81bfb217b1541ace0e4e96b01e55a2248b9c12777f0cdcff

    • SHA512

      cca40ca3b2da96919a9ed64ef0ad23089258e8e0ef2921b2d0eedff22cfae071c22afac1b85029078bed123cdba31d7a5910620f3bb0a650cbc5d98eaf60787d

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks