Overview

overview

10

Static

static

10

c9a22e8c86...94.exe

windows7_x64

10

c9a22e8c86...94.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c9a22e8c8683de57190b21c85d7adc156a960a898dbe448d6fe3269700d50294

  • Size

    89KB

  • Sample

    220130-qbhwtacae7

  • MD5

    8f523f7fc73e52d54bb4e94dc44768b0

  • SHA1

    0b491bc29d8cab94b7a0b7876faf3a81c482561d

  • SHA256

    c9a22e8c8683de57190b21c85d7adc156a960a898dbe448d6fe3269700d50294

  • SHA512

    4a650194faefaf67a7904b70a76c0abf55864b21161a04a868e18e5dff50a9792d85fc4abe2e6fde17aa3acdce678e067e31f303d32ffe931303775a17467c7c

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      c9a22e8c8683de57190b21c85d7adc156a960a898dbe448d6fe3269700d50294

    • Size

      89KB

    • MD5

      8f523f7fc73e52d54bb4e94dc44768b0

    • SHA1

      0b491bc29d8cab94b7a0b7876faf3a81c482561d

    • SHA256

      c9a22e8c8683de57190b21c85d7adc156a960a898dbe448d6fe3269700d50294

    • SHA512

      4a650194faefaf67a7904b70a76c0abf55864b21161a04a868e18e5dff50a9792d85fc4abe2e6fde17aa3acdce678e067e31f303d32ffe931303775a17467c7c

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks