Overview

overview

10

Static

static

10

5237b0fdd9...14.exe

windows7_x64

10

5237b0fdd9...14.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5237b0fdd9522d8e5ea6de336d4cc24daeb5823454f9b5d42d16a4656ef8f114

  • Size

    89KB

  • Sample

    220122-aa38cseaa8

  • MD5

    f2d59757a9795531796df91097d5fa2b

  • SHA1

    42c647d83abe1e5438b8176b9e90db08282a8bbb

  • SHA256

    5237b0fdd9522d8e5ea6de336d4cc24daeb5823454f9b5d42d16a4656ef8f114

  • SHA512

    5d8b65b4654bfbcf4b507c376a762d2182a5394e0e4f7474bdc490eff74710f260486e469a9952ebce9300f28c879531411c28f6fcb96cf9d5e08646beae9a67

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      5237b0fdd9522d8e5ea6de336d4cc24daeb5823454f9b5d42d16a4656ef8f114

    • Size

      89KB

    • MD5

      f2d59757a9795531796df91097d5fa2b

    • SHA1

      42c647d83abe1e5438b8176b9e90db08282a8bbb

    • SHA256

      5237b0fdd9522d8e5ea6de336d4cc24daeb5823454f9b5d42d16a4656ef8f114

    • SHA512

      5d8b65b4654bfbcf4b507c376a762d2182a5394e0e4f7474bdc490eff74710f260486e469a9952ebce9300f28c879531411c28f6fcb96cf9d5e08646beae9a67

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks