Overview

overview

10

Static

static

10

6a578d0a4c...9a.exe

windows7_x64

10

6a578d0a4c...9a.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6a578d0a4c6ba0cae2f627b058a2167214e91545c2502d0750853d72f88af69a

  • Size

    79KB

  • Sample

    220131-az15ascgcn

  • MD5

    1098e66986134d71d4a8dd07301640b1

  • SHA1

    fd78201a8b50582430a34aed22ee9fc4ff9c9c3b

  • SHA256

    6a578d0a4c6ba0cae2f627b058a2167214e91545c2502d0750853d72f88af69a

  • SHA512

    ee97d354fbe2c2fc1a7d901147d607e5482124e82a0448328982849fa90abe758403557e11dcdfbc8d85cb0c9f40599c72c3bae1a58de6b9d0357acefeee9b8f

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      6a578d0a4c6ba0cae2f627b058a2167214e91545c2502d0750853d72f88af69a

    • Size

      79KB

    • MD5

      1098e66986134d71d4a8dd07301640b1

    • SHA1

      fd78201a8b50582430a34aed22ee9fc4ff9c9c3b

    • SHA256

      6a578d0a4c6ba0cae2f627b058a2167214e91545c2502d0750853d72f88af69a

    • SHA512

      ee97d354fbe2c2fc1a7d901147d607e5482124e82a0448328982849fa90abe758403557e11dcdfbc8d85cb0c9f40599c72c3bae1a58de6b9d0357acefeee9b8f

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks