Overview

overview

10

Static

static

10

2a8b4c22b7...11.exe

windows7_x64

10

2a8b4c22b7...11.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2a8b4c22b7a6f0bcd3e11490ce76860ee84b64e7900b90fb7ee1c1cd63432311

  • Size

    89KB

  • Sample

    220130-1khmhsbga2

  • MD5

    2414d83e97cb4c442b5594c6fbafe045

  • SHA1

    de8d37c0a87c4fa536e9728cd2b0976c9bb7a328

  • SHA256

    2a8b4c22b7a6f0bcd3e11490ce76860ee84b64e7900b90fb7ee1c1cd63432311

  • SHA512

    611dc02544c85b1964313d0eb37c9ac30b811fbce42b833b1ed20fbcceca8603b3c0f9251bb777c6929f63ae57b31595162a17095c9291903e1459ec04620fd2

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      2a8b4c22b7a6f0bcd3e11490ce76860ee84b64e7900b90fb7ee1c1cd63432311

    • Size

      89KB

    • MD5

      2414d83e97cb4c442b5594c6fbafe045

    • SHA1

      de8d37c0a87c4fa536e9728cd2b0976c9bb7a328

    • SHA256

      2a8b4c22b7a6f0bcd3e11490ce76860ee84b64e7900b90fb7ee1c1cd63432311

    • SHA512

      611dc02544c85b1964313d0eb37c9ac30b811fbce42b833b1ed20fbcceca8603b3c0f9251bb777c6929f63ae57b31595162a17095c9291903e1459ec04620fd2

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks