Overview

overview

10

Static

static

10

ad382c5acb...e6.exe

windows7_x64

10

ad382c5acb...e6.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ad382c5acb55890cb0f62880897b5b25455d8f0d30bf2985bdc2ac04f6f85ce6

  • Size

    89KB

  • Sample

    220130-wvma8sghd8

  • MD5

    5ff5916c9f7c593d1d589c97c571b45a

  • SHA1

    9d65a6cd35f8aacdf0965a3c4c1e609fefd97157

  • SHA256

    ad382c5acb55890cb0f62880897b5b25455d8f0d30bf2985bdc2ac04f6f85ce6

  • SHA512

    c59be83ada047f3742ee87900516d5f66863a16139b6f39cfc266b62b763b8a9defabff2120ad880b43d6efb6de804b2d417fd0d29a92a64157dc1e7034f4633

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      ad382c5acb55890cb0f62880897b5b25455d8f0d30bf2985bdc2ac04f6f85ce6

    • Size

      89KB

    • MD5

      5ff5916c9f7c593d1d589c97c571b45a

    • SHA1

      9d65a6cd35f8aacdf0965a3c4c1e609fefd97157

    • SHA256

      ad382c5acb55890cb0f62880897b5b25455d8f0d30bf2985bdc2ac04f6f85ce6

    • SHA512

      c59be83ada047f3742ee87900516d5f66863a16139b6f39cfc266b62b763b8a9defabff2120ad880b43d6efb6de804b2d417fd0d29a92a64157dc1e7034f4633

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks