Overview

overview

10

Static

static

10

5e3e8801c6...97.exe

windows7_x64

10

5e3e8801c6...97.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5e3e8801c64b43a2c7838bc7d8f76f113be5c2efd8fe1e0e4c8d984a7d247597

  • Size

    79KB

  • Sample

    220131-aw6klscfgq

  • MD5

    1a6c43b693bb49dad5fe1637b02da2c6

  • SHA1

    17b541c9f9a33464d6272276f7c398d58303b8f0

  • SHA256

    5e3e8801c64b43a2c7838bc7d8f76f113be5c2efd8fe1e0e4c8d984a7d247597

  • SHA512

    be76c3f94d3a856bb0cbab391fd45645b70372052edf31a11285f86f3417ca0dde6994355b80ba9136e12700c79aa660ff674db6f6479346acd146f8c56f4957

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      5e3e8801c64b43a2c7838bc7d8f76f113be5c2efd8fe1e0e4c8d984a7d247597

    • Size

      79KB

    • MD5

      1a6c43b693bb49dad5fe1637b02da2c6

    • SHA1

      17b541c9f9a33464d6272276f7c398d58303b8f0

    • SHA256

      5e3e8801c64b43a2c7838bc7d8f76f113be5c2efd8fe1e0e4c8d984a7d247597

    • SHA512

      be76c3f94d3a856bb0cbab391fd45645b70372052edf31a11285f86f3417ca0dde6994355b80ba9136e12700c79aa660ff674db6f6479346acd146f8c56f4957

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks