Overview

overview

10

Static

static

10

898b9cc780...b9.exe

windows7_x64

10

898b9cc780...b9.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    898b9cc780196111ebf157de1fbb8362abf21da678147f1198d237017c896cb9

  • Size

    89KB

  • Sample

    220130-wn234sgfh6

  • MD5

    62d4777dd8953743d26510f00b74f444

  • SHA1

    8e23f62d8701f9e050c241680c15c3220bf78228

  • SHA256

    898b9cc780196111ebf157de1fbb8362abf21da678147f1198d237017c896cb9

  • SHA512

    9efb88bfb322e741e7d67411cb01581cd2b81b71920688840c3ffbc746f2c9250964aca8b4f146c9e70f7f809602059cc455dc8f7ffbfff8c9a1c9ced557cfe3

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      898b9cc780196111ebf157de1fbb8362abf21da678147f1198d237017c896cb9

    • Size

      89KB

    • MD5

      62d4777dd8953743d26510f00b74f444

    • SHA1

      8e23f62d8701f9e050c241680c15c3220bf78228

    • SHA256

      898b9cc780196111ebf157de1fbb8362abf21da678147f1198d237017c896cb9

    • SHA512

      9efb88bfb322e741e7d67411cb01581cd2b81b71920688840c3ffbc746f2c9250964aca8b4f146c9e70f7f809602059cc455dc8f7ffbfff8c9a1c9ced557cfe3

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks