Overview

overview

10

Static

static

10

0596e3f67a...14.exe

windows7_x64

10

0596e3f67a...14.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0596e3f67a43d3481fa7fadf17ccc073d377b72a7fe753d64a648f153d53fa14

  • Size

    89KB

  • Sample

    220130-wxlgqaghh8

  • MD5

    5eea7686abeba0affa7efce4da31f277

  • SHA1

    0270bab0ec46b92c430542631304110b5d6bdbbc

  • SHA256

    0596e3f67a43d3481fa7fadf17ccc073d377b72a7fe753d64a648f153d53fa14

  • SHA512

    68e3b055bbab7c54911436345368a8fbefb4a4052a623933f968772109fa019ce531ceb7629eedc5f3f49b323e77b7af8750557aadab8c5a54e0ca9a3d9496b5

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0596e3f67a43d3481fa7fadf17ccc073d377b72a7fe753d64a648f153d53fa14

    • Size

      89KB

    • MD5

      5eea7686abeba0affa7efce4da31f277

    • SHA1

      0270bab0ec46b92c430542631304110b5d6bdbbc

    • SHA256

      0596e3f67a43d3481fa7fadf17ccc073d377b72a7fe753d64a648f153d53fa14

    • SHA512

      68e3b055bbab7c54911436345368a8fbefb4a4052a623933f968772109fa019ce531ceb7629eedc5f3f49b323e77b7af8750557aadab8c5a54e0ca9a3d9496b5

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks