Overview

overview

10

Static

static

10

621cabafa0...51.exe

windows7_x64

10

621cabafa0...51.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    621cabafa0320c01dc1eb106071b1cc5d0fd0a181bf0fab6e0ab2e4bd7d14751

  • Size

    89KB

  • Sample

    220130-qy3jqsceb7

  • MD5

    8542cf0d32b7c711d92089a7d442333e

  • SHA1

    e9ff8095d747309492c97a9c18e323a30fe358e6

  • SHA256

    621cabafa0320c01dc1eb106071b1cc5d0fd0a181bf0fab6e0ab2e4bd7d14751

  • SHA512

    0d61a722eff62be08db9190be28b844bea6d6bc195be19528641fea28fc6bd733805bb5b2f93f84c6fd8297e8b50b940742d568b9d039532def3f25268c729bb

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      621cabafa0320c01dc1eb106071b1cc5d0fd0a181bf0fab6e0ab2e4bd7d14751

    • Size

      89KB

    • MD5

      8542cf0d32b7c711d92089a7d442333e

    • SHA1

      e9ff8095d747309492c97a9c18e323a30fe358e6

    • SHA256

      621cabafa0320c01dc1eb106071b1cc5d0fd0a181bf0fab6e0ab2e4bd7d14751

    • SHA512

      0d61a722eff62be08db9190be28b844bea6d6bc195be19528641fea28fc6bd733805bb5b2f93f84c6fd8297e8b50b940742d568b9d039532def3f25268c729bb

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks