Overview

overview

10

Static

static

10

81f2a6dc51...06.exe

windows7_x64

10

81f2a6dc51...06.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    81f2a6dc518fb6d785e4a64d29ae5fd9b7a9140b98bded7c010f47f223f2d106

  • Size

    89KB

  • Sample

    220130-wmpfmagff5

  • MD5

    638304bf859e7be2f0fa39a655fdaffc

  • SHA1

    646d54222f020f92fe2e0533c676bb104004686c

  • SHA256

    81f2a6dc518fb6d785e4a64d29ae5fd9b7a9140b98bded7c010f47f223f2d106

  • SHA512

    fce95cbba24ef5b3aa74e70523b28ac9e074928a2e6b3786c7ff8dd6604704ae2c8c80afa3f6812bfbe5d3400a5bd3c3bb8f3db095c3dcc5fc416a9647fa4803

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      81f2a6dc518fb6d785e4a64d29ae5fd9b7a9140b98bded7c010f47f223f2d106

    • Size

      89KB

    • MD5

      638304bf859e7be2f0fa39a655fdaffc

    • SHA1

      646d54222f020f92fe2e0533c676bb104004686c

    • SHA256

      81f2a6dc518fb6d785e4a64d29ae5fd9b7a9140b98bded7c010f47f223f2d106

    • SHA512

      fce95cbba24ef5b3aa74e70523b28ac9e074928a2e6b3786c7ff8dd6604704ae2c8c80afa3f6812bfbe5d3400a5bd3c3bb8f3db095c3dcc5fc416a9647fa4803

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks