Overview

overview

10

Static

static

10

7196802e16...a8.exe

windows7_x64

10

7196802e16...a8.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7196802e1634b56f2dda7f5c63bd4698f9084e832630ec4c2cefa8884fe023a8

  • Size

    79KB

  • Sample

    220130-2qptfsbfaj

  • MD5

    bb57362757182b928d66d4963104ffe8

  • SHA1

    1973a05e8f4cdc69fcfd4cbadf80587ea701d0e4

  • SHA256

    7196802e1634b56f2dda7f5c63bd4698f9084e832630ec4c2cefa8884fe023a8

  • SHA512

    d5b58deaaa121789ad0452aa7da2f6810ed7035e9b51cfbc11bfae13d6f1eca2255b99ba0a902c4129455cb446e0d438d0abd56ca4e24f891ae492d0570e2a5f

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      7196802e1634b56f2dda7f5c63bd4698f9084e832630ec4c2cefa8884fe023a8

    • Size

      79KB

    • MD5

      bb57362757182b928d66d4963104ffe8

    • SHA1

      1973a05e8f4cdc69fcfd4cbadf80587ea701d0e4

    • SHA256

      7196802e1634b56f2dda7f5c63bd4698f9084e832630ec4c2cefa8884fe023a8

    • SHA512

      d5b58deaaa121789ad0452aa7da2f6810ed7035e9b51cfbc11bfae13d6f1eca2255b99ba0a902c4129455cb446e0d438d0abd56ca4e24f891ae492d0570e2a5f

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks