Overview

overview

10

Static

static

fc404ae4e9...15.exe

windows7_x64

10

fc404ae4e9...15.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fc404ae4e968d35421598be460be1ca7e87128cc247be1905c29c560fb015915

  • Size

    117KB

  • Sample

    220121-3wtj9seafq

  • MD5

    fe74dc43af839146f64ec7bea752c4f0

  • SHA1

    570e72586b5451afef9a05fede4a9cd8f51cfc9a

  • SHA256

    fc404ae4e968d35421598be460be1ca7e87128cc247be1905c29c560fb015915

  • SHA512

    4bea67cdfe8121e1f51863cddce0d7d331a5fbb438319df8c571992b9d90cbc852a3c3e2e9da898e576d2da8f5b7e78c437deb5d3d8d496fb84866266d43711d

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      fc404ae4e968d35421598be460be1ca7e87128cc247be1905c29c560fb015915

    • Size

      117KB

    • MD5

      fe74dc43af839146f64ec7bea752c4f0

    • SHA1

      570e72586b5451afef9a05fede4a9cd8f51cfc9a

    • SHA256

      fc404ae4e968d35421598be460be1ca7e87128cc247be1905c29c560fb015915

    • SHA512

      4bea67cdfe8121e1f51863cddce0d7d331a5fbb438319df8c571992b9d90cbc852a3c3e2e9da898e576d2da8f5b7e78c437deb5d3d8d496fb84866266d43711d

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks