Overview

overview

10

Static

static

10

731ef5fc57...b4.exe

windows7_x64

10

731ef5fc57...b4.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    731ef5fc57a5669b09af844c8c401efe9aac51f88dea756d851e9908c63995b4

  • Size

    92KB

  • Sample

    220131-bcd7padfc9

  • MD5

    0a2c6265a65a25e9bef80f55cdd62229

  • SHA1

    fbead56bcbc0a8a63b744ca37a98a6523945295e

  • SHA256

    731ef5fc57a5669b09af844c8c401efe9aac51f88dea756d851e9908c63995b4

  • SHA512

    70e6f2f75cb7e38bc774b40d3dcc92a11c8701014d0c2e0ff6260017562b0cbf62a0cff1897cf0731bc319caafff47dd1b5dfe19cac1bb6a201760902e973651

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      731ef5fc57a5669b09af844c8c401efe9aac51f88dea756d851e9908c63995b4

    • Size

      92KB

    • MD5

      0a2c6265a65a25e9bef80f55cdd62229

    • SHA1

      fbead56bcbc0a8a63b744ca37a98a6523945295e

    • SHA256

      731ef5fc57a5669b09af844c8c401efe9aac51f88dea756d851e9908c63995b4

    • SHA512

      70e6f2f75cb7e38bc774b40d3dcc92a11c8701014d0c2e0ff6260017562b0cbf62a0cff1897cf0731bc319caafff47dd1b5dfe19cac1bb6a201760902e973651

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks