Overview

overview

10

Static

static

10

d5d024a63d...59.exe

windows7_x64

10

d5d024a63d...59.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d5d024a63dbc694980ec512dae9694334acc3de16b0c29b22faf707eb70ad159

  • Size

    79KB

  • Sample

    220131-bhmq1sdadr

  • MD5

    065aa01311ca8f3e0016d8ae546d30a4

  • SHA1

    fd4fc9439e932952dfb9ef5ce25312aeb70358b1

  • SHA256

    d5d024a63dbc694980ec512dae9694334acc3de16b0c29b22faf707eb70ad159

  • SHA512

    ce244bf0d7bcac927be6f2b29302314f4b1b6016323d14758c564a4935ebb359d2a3ff0dd816a2ef98cc7fe4cdc7c28d3441d7a3cf74bed688b9be8ee75fa4ff

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      d5d024a63dbc694980ec512dae9694334acc3de16b0c29b22faf707eb70ad159

    • Size

      79KB

    • MD5

      065aa01311ca8f3e0016d8ae546d30a4

    • SHA1

      fd4fc9439e932952dfb9ef5ce25312aeb70358b1

    • SHA256

      d5d024a63dbc694980ec512dae9694334acc3de16b0c29b22faf707eb70ad159

    • SHA512

      ce244bf0d7bcac927be6f2b29302314f4b1b6016323d14758c564a4935ebb359d2a3ff0dd816a2ef98cc7fe4cdc7c28d3441d7a3cf74bed688b9be8ee75fa4ff

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks