Overview

overview

10

Static

static

8

6c2a5e3bda...96.exe

windows7-x64

10

6c2a5e3bda...96.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6c2a5e3bda43426781fbb5693fdf2a96

  • Size

    43KB

  • Sample

    220906-1ey3baffhk

  • MD5

    6c2a5e3bda43426781fbb5693fdf2a96

  • SHA1

    32f70a92f99232b52e1f9683d2788c7c90ed5df0

  • SHA256

    1b5cce8b8a38d3caef308cb2200f7a3c5439f47936e63e0a9683e5c80f44116b

  • SHA512

    416964a6224ad459b8875f45eb19f4750da1cfd63cac2412c36c1918898a9d66a9750453bf2964f4ccbd311e804864f7fe97ed8d3f3ff80e7ce430d7a6953c4d

  • SSDEEP

    384:MnyhSksAVndb4G3w2NMsG9OqvhyY3Q6oVxYwwsRhg7+iXXRodY6kLdAeMB:1hSksandb4GgyMsp4hyYtoVxYdT7ZXqJ

Score
10/10
sakulapersistencerattrojanupx

Malware Config

Targets

    • Target

      6c2a5e3bda43426781fbb5693fdf2a96

    • Size

      43KB

    • MD5

      6c2a5e3bda43426781fbb5693fdf2a96

    • SHA1

      32f70a92f99232b52e1f9683d2788c7c90ed5df0

    • SHA256

      1b5cce8b8a38d3caef308cb2200f7a3c5439f47936e63e0a9683e5c80f44116b

    • SHA512

      416964a6224ad459b8875f45eb19f4750da1cfd63cac2412c36c1918898a9d66a9750453bf2964f4ccbd311e804864f7fe97ed8d3f3ff80e7ce430d7a6953c4d

    • SSDEEP

      384:MnyhSksAVndb4G3w2NMsG9OqvhyY3Q6oVxYwwsRhg7+iXXRodY6kLdAeMB:1hSksandb4GgyMsp4hyYtoVxYdT7ZXqJ

    Score
    10/10
    sakulapersistencerattrojanupx

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks