Overview

overview

10

Static

static

10

8e26bd2a3f...b6.exe

windows7_x64

10

8e26bd2a3f...b6.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8e26bd2a3f142ee7042483930f5ab49ed67dbde2f2a74b97a3bd1a03cf718eb6

  • Size

    79KB

  • Sample

    220130-2rt5kabfbl

  • MD5

    b4958424c5db8b0eca61ce836b81d192

  • SHA1

    11964209ef14ff3e54f15bc00a2cf87563b02226

  • SHA256

    8e26bd2a3f142ee7042483930f5ab49ed67dbde2f2a74b97a3bd1a03cf718eb6

  • SHA512

    413aaf9bb6180c8b9d417e22f0c286463109ab84b42613ba4c9cc289b831ad852f98fe4c0c22fb8535699752f75be34646e0a3018a1b0e427fd6c84ca19f3dbc

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      8e26bd2a3f142ee7042483930f5ab49ed67dbde2f2a74b97a3bd1a03cf718eb6

    • Size

      79KB

    • MD5

      b4958424c5db8b0eca61ce836b81d192

    • SHA1

      11964209ef14ff3e54f15bc00a2cf87563b02226

    • SHA256

      8e26bd2a3f142ee7042483930f5ab49ed67dbde2f2a74b97a3bd1a03cf718eb6

    • SHA512

      413aaf9bb6180c8b9d417e22f0c286463109ab84b42613ba4c9cc289b831ad852f98fe4c0c22fb8535699752f75be34646e0a3018a1b0e427fd6c84ca19f3dbc

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks