Overview

overview

10

Static

static

10

19c96e06c7...aa.exe

windows7_x64

10

19c96e06c7...aa.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    19c96e06c7e5f7c19611b44ff28293a1a73b32c1a7f57149c51974ee017d3daa

  • Size

    79KB

  • Sample

    220130-3x6afsdac4

  • MD5

    3b70ab484857b6e96e62e239c937dea6

  • SHA1

    fae910f1d2d2797beea25d0ec4f5ce9a3fad93d5

  • SHA256

    19c96e06c7e5f7c19611b44ff28293a1a73b32c1a7f57149c51974ee017d3daa

  • SHA512

    edfdb43ac7cf9c48a43cd8aa819d4b7331cc374667329bc52899ed3ffbe5be87934264dfdbdd3eed4ccc55fb49a39285efec2fc87ecc854496b31461fd6cae20

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      19c96e06c7e5f7c19611b44ff28293a1a73b32c1a7f57149c51974ee017d3daa

    • Size

      79KB

    • MD5

      3b70ab484857b6e96e62e239c937dea6

    • SHA1

      fae910f1d2d2797beea25d0ec4f5ce9a3fad93d5

    • SHA256

      19c96e06c7e5f7c19611b44ff28293a1a73b32c1a7f57149c51974ee017d3daa

    • SHA512

      edfdb43ac7cf9c48a43cd8aa819d4b7331cc374667329bc52899ed3ffbe5be87934264dfdbdd3eed4ccc55fb49a39285efec2fc87ecc854496b31461fd6cae20

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks