Overview

overview

10

Static

static

10

8014fc78a9...8b.exe

windows7_x64

10

8014fc78a9...8b.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8014fc78a954141852ee11229a254681c7860c1adf52bd2f1327c3176ed1d68b

  • Size

    79KB

  • Sample

    220130-31b6sadaf2

  • MD5

    3a1df1ec3ef499bb59f07845e7621155

  • SHA1

    61916fec02fd047c324af5d51c2490313e70d0e2

  • SHA256

    8014fc78a954141852ee11229a254681c7860c1adf52bd2f1327c3176ed1d68b

  • SHA512

    ba558db509a8a148d20605160da55cde7d01aae7542f4443f04030e018a1cb67aba8bcd0b0497d3142d258a5320dcf705f70f2393e4dbce4d9b970f22c32d866

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      8014fc78a954141852ee11229a254681c7860c1adf52bd2f1327c3176ed1d68b

    • Size

      79KB

    • MD5

      3a1df1ec3ef499bb59f07845e7621155

    • SHA1

      61916fec02fd047c324af5d51c2490313e70d0e2

    • SHA256

      8014fc78a954141852ee11229a254681c7860c1adf52bd2f1327c3176ed1d68b

    • SHA512

      ba558db509a8a148d20605160da55cde7d01aae7542f4443f04030e018a1cb67aba8bcd0b0497d3142d258a5320dcf705f70f2393e4dbce4d9b970f22c32d866

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks