Overview

overview

10

Static

static

10

e49c193214...b0.exe

windows7_x64

10

e49c193214...b0.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e49c193214ddac4e3754a1818d322ad648614f7258504357335148857d0fdcb0

  • Size

    92KB

  • Sample

    220121-3x43dsebcn

  • MD5

    fbd85dad36fe13d46eaca7d7f2d50b0b

  • SHA1

    ebcd3b4728151786661eab9640b6cb83665cf10b

  • SHA256

    e49c193214ddac4e3754a1818d322ad648614f7258504357335148857d0fdcb0

  • SHA512

    572b67083fe5060ea643d710b80ca0a3210827e5de81bdda8973eabafeef015598ea9da220ac24deebe59a607ae83162f714a9f828dee75b9767e4c69eb2ff02

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      e49c193214ddac4e3754a1818d322ad648614f7258504357335148857d0fdcb0

    • Size

      92KB

    • MD5

      fbd85dad36fe13d46eaca7d7f2d50b0b

    • SHA1

      ebcd3b4728151786661eab9640b6cb83665cf10b

    • SHA256

      e49c193214ddac4e3754a1818d322ad648614f7258504357335148857d0fdcb0

    • SHA512

      572b67083fe5060ea643d710b80ca0a3210827e5de81bdda8973eabafeef015598ea9da220ac24deebe59a607ae83162f714a9f828dee75b9767e4c69eb2ff02

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks