Overview

overview

10

Static

static

10

0df2c40c53...30.exe

windows7_x64

10

0df2c40c53...30.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0df2c40c53e601e9128c2644c10c8d7a9e4dd9d8fffc5d27b6f28df7b7ff8930

  • Size

    92KB

  • Sample

    220130-2j9kaabecn

  • MD5

    124089995494be38d866de08c12f99ef

  • SHA1

    8f9d32b0c754b53ee78d8ab538c27f980c5d523d

  • SHA256

    0df2c40c53e601e9128c2644c10c8d7a9e4dd9d8fffc5d27b6f28df7b7ff8930

  • SHA512

    06e021f6663f3a56a993bffc8f14320c6cfa720dfccf9fec6458b43445dacb9f38d570c7239e09884bb9faf86ff12e5791d57773c86b9342aa1afd3363f09fc6

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0df2c40c53e601e9128c2644c10c8d7a9e4dd9d8fffc5d27b6f28df7b7ff8930

    • Size

      92KB

    • MD5

      124089995494be38d866de08c12f99ef

    • SHA1

      8f9d32b0c754b53ee78d8ab538c27f980c5d523d

    • SHA256

      0df2c40c53e601e9128c2644c10c8d7a9e4dd9d8fffc5d27b6f28df7b7ff8930

    • SHA512

      06e021f6663f3a56a993bffc8f14320c6cfa720dfccf9fec6458b43445dacb9f38d570c7239e09884bb9faf86ff12e5791d57773c86b9342aa1afd3363f09fc6

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks