Overview

overview

10

Static

static

10

98b2fa93b8...87.exe

windows7_x64

10

98b2fa93b8...87.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    98b2fa93b884c2708f8a3eafeb3c203711e64e718d0a91fe456146612db3b987

  • Size

    79KB

  • Sample

    220130-aetjqacdf9

  • MD5

    023ef99bc3c84b8df3f837454c0e1629

  • SHA1

    a6c4a242ef5f5657d4c39ed7de075f0d6bcbaadf

  • SHA256

    98b2fa93b884c2708f8a3eafeb3c203711e64e718d0a91fe456146612db3b987

  • SHA512

    9da14aed7b424b1d046b2b7d27a596d807b48186943f2dc338e07245a0f7bfaa7c52bd0f999562616925c4f5c601e2e62afdba808e674ad6dad1e010bed769d4

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      98b2fa93b884c2708f8a3eafeb3c203711e64e718d0a91fe456146612db3b987

    • Size

      79KB

    • MD5

      023ef99bc3c84b8df3f837454c0e1629

    • SHA1

      a6c4a242ef5f5657d4c39ed7de075f0d6bcbaadf

    • SHA256

      98b2fa93b884c2708f8a3eafeb3c203711e64e718d0a91fe456146612db3b987

    • SHA512

      9da14aed7b424b1d046b2b7d27a596d807b48186943f2dc338e07245a0f7bfaa7c52bd0f999562616925c4f5c601e2e62afdba808e674ad6dad1e010bed769d4

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks