Overview

overview

10

Static

static

10

412923a77c...05.exe

windows7_x64

10

412923a77c...05.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    412923a77ce64d851568c6e38fe78efb804ad38fe3ed11eb174338724117ee05

  • Size

    79KB

  • Sample

    220131-ba3r9sdfb2

  • MD5

    0ae8ace203031f32e9b1ac5696c0c070

  • SHA1

    11f2f2efff557e645d4dd23c5750d3104f6cc851

  • SHA256

    412923a77ce64d851568c6e38fe78efb804ad38fe3ed11eb174338724117ee05

  • SHA512

    ca182e2fea011355ae702a444beafe2d37391fd3d416f7cdfaf9fe38fe6b6518ed120bca29106cf3fa851069bc17f1305d6089190a14edc35b62ea7e9e546428

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      412923a77ce64d851568c6e38fe78efb804ad38fe3ed11eb174338724117ee05

    • Size

      79KB

    • MD5

      0ae8ace203031f32e9b1ac5696c0c070

    • SHA1

      11f2f2efff557e645d4dd23c5750d3104f6cc851

    • SHA256

      412923a77ce64d851568c6e38fe78efb804ad38fe3ed11eb174338724117ee05

    • SHA512

      ca182e2fea011355ae702a444beafe2d37391fd3d416f7cdfaf9fe38fe6b6518ed120bca29106cf3fa851069bc17f1305d6089190a14edc35b62ea7e9e546428

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks