Overview

overview

10

Static

static

10

7f562e82db...17.exe

windows7_x64

10

7f562e82db...17.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7f562e82dbbf72cec6fca529950f85bed7b373621d2833644343768e85cf6217

  • Size

    89KB

  • Sample

    220130-z7wxzsbee4

  • MD5

    29bd6cfc21250dfa348597a21a4a012b

  • SHA1

    6c5bab7edf1630d8b8b36d631ea3d18e3aad946c

  • SHA256

    7f562e82dbbf72cec6fca529950f85bed7b373621d2833644343768e85cf6217

  • SHA512

    a359eda4f6c23c69e574e819468fca4169135518d6a791f8fd45a5e1e86819b0196a066ef31a8e9ed6a6fcedb51967dc34976ab1a72b2a9366ae01b6248f035f

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      7f562e82dbbf72cec6fca529950f85bed7b373621d2833644343768e85cf6217

    • Size

      89KB

    • MD5

      29bd6cfc21250dfa348597a21a4a012b

    • SHA1

      6c5bab7edf1630d8b8b36d631ea3d18e3aad946c

    • SHA256

      7f562e82dbbf72cec6fca529950f85bed7b373621d2833644343768e85cf6217

    • SHA512

      a359eda4f6c23c69e574e819468fca4169135518d6a791f8fd45a5e1e86819b0196a066ef31a8e9ed6a6fcedb51967dc34976ab1a72b2a9366ae01b6248f035f

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks