Overview

overview

10

Static

static

50fa6fff60...12.exe

windows7_x64

10

50fa6fff60...12.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    50fa6fff60ad5a33c55f2d87299a46d3f1aa8631524311349ef9bd83566e1a12

  • Size

    104KB

  • Sample

    220130-yawqaahdcj

  • MD5

    4a7b4635af040cba1851b2f57254ba5e

  • SHA1

    a25e851fcc3e2212e52f4f3a98aa1fd23e1e4c98

  • SHA256

    50fa6fff60ad5a33c55f2d87299a46d3f1aa8631524311349ef9bd83566e1a12

  • SHA512

    a0b1474305ca0f6b282fdbcc12a3660baa330186ecde8b3981920f893b6f6728a98b93129566e6b3de027b72508a60ea2023506f7604ba6928dd9368f98124d6

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      50fa6fff60ad5a33c55f2d87299a46d3f1aa8631524311349ef9bd83566e1a12

    • Size

      104KB

    • MD5

      4a7b4635af040cba1851b2f57254ba5e

    • SHA1

      a25e851fcc3e2212e52f4f3a98aa1fd23e1e4c98

    • SHA256

      50fa6fff60ad5a33c55f2d87299a46d3f1aa8631524311349ef9bd83566e1a12

    • SHA512

      a0b1474305ca0f6b282fdbcc12a3660baa330186ecde8b3981920f893b6f6728a98b93129566e6b3de027b72508a60ea2023506f7604ba6928dd9368f98124d6

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks