Overview

overview

10

Static

static

10

aae00d6fbd...80.exe

windows7_x64

10

aae00d6fbd...80.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aae00d6fbdae1f415927ca95f3451032b3cab7384a5aab5b087ebd8601942d80

  • Size

    79KB

  • Sample

    220130-2rbyzsbfap

  • MD5

    b7e3f853e98ea9db74bf3429803f7a4b

  • SHA1

    9076608ecf15dbd0fdff609c51842e38479dc55e

  • SHA256

    aae00d6fbdae1f415927ca95f3451032b3cab7384a5aab5b087ebd8601942d80

  • SHA512

    9b76ebef8b6eaec4464393f811b5715987b3530b2f119f7bef017a5f9896a6407417185bf54c21813f6e87dc5905cb39ba9adb533de64c08462a16e2c8207fe6

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      aae00d6fbdae1f415927ca95f3451032b3cab7384a5aab5b087ebd8601942d80

    • Size

      79KB

    • MD5

      b7e3f853e98ea9db74bf3429803f7a4b

    • SHA1

      9076608ecf15dbd0fdff609c51842e38479dc55e

    • SHA256

      aae00d6fbdae1f415927ca95f3451032b3cab7384a5aab5b087ebd8601942d80

    • SHA512

      9b76ebef8b6eaec4464393f811b5715987b3530b2f119f7bef017a5f9896a6407417185bf54c21813f6e87dc5905cb39ba9adb533de64c08462a16e2c8207fe6

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks