Overview

overview

10

Static

static

10

d2a627abb4...28.exe

windows7_x64

10

d2a627abb4...28.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d2a627abb4e73e3e0b479e4da45c10751992f5c438aa10b18a7a94e2481e1828

  • Size

    79KB

  • Sample

    220130-2s1zhabfcq

  • MD5

    aca2756917024c859d1f13ca1cdcb843

  • SHA1

    eb95ecbf4e382aba4fd02862dfcb69a2a839324d

  • SHA256

    d2a627abb4e73e3e0b479e4da45c10751992f5c438aa10b18a7a94e2481e1828

  • SHA512

    d2437eb2a47fb2671a16be8e0cd74f6aa77b7548eccd768b9f0b16b19e080eb462d73ddf967d0da0735bf5b2e8a2819185092efc1c789fd18116cb615f081dda

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      d2a627abb4e73e3e0b479e4da45c10751992f5c438aa10b18a7a94e2481e1828

    • Size

      79KB

    • MD5

      aca2756917024c859d1f13ca1cdcb843

    • SHA1

      eb95ecbf4e382aba4fd02862dfcb69a2a839324d

    • SHA256

      d2a627abb4e73e3e0b479e4da45c10751992f5c438aa10b18a7a94e2481e1828

    • SHA512

      d2437eb2a47fb2671a16be8e0cd74f6aa77b7548eccd768b9f0b16b19e080eb462d73ddf967d0da0735bf5b2e8a2819185092efc1c789fd18116cb615f081dda

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks