sakula | 91490bff054fa248fd40f33cd7b5cd7c06b56b0d61fbacea4f55f20444042bcf | Triage

Submit
Reports

Overview

overview

Static

static

91490bff05...cf.exe

windows7-x64

91490bff05...cf.exe

windows10-2004-x64

Sharing

General

Target

91490bff054fa248fd40f33cd7b5cd7c06b56b0d61fbacea4f55f20444042bcf
Size

79KB
Sample

230809-29jrjsgb73
MD5

549231ffdfd99eee6ed23542d0876b70
SHA1

df18c69fdef7bf0f01c0128c78cf6725d37d049d
SHA256

91490bff054fa248fd40f33cd7b5cd7c06b56b0d61fbacea4f55f20444042bcf
SHA512

d3ea472ef9d1da543fd23f6bf419a98100f38341871fded2a5ed71d3d8216f23b3474ecac7a174a0e8bae4c8c80a4ce2dc97171389a50518fb2cc71025ddb05c
SSDEEP

1536:MSoaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtro9:M90hpgz6xGhTjwHN30BE9

Score

10^/10

sakula persistence rat trojan

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

91490bff054fa248fd40f33cd7b5cd7c06b56b0d61fbacea4f55f20444042bcf.exe

Resource

win7-20230712-en

sakula persistence rat trojan

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

91490bff054fa248fd40f33cd7b5cd7c06b56b0d61fbacea4f55f20444042bcf.exe

Resource

win10v2004-20230703-en

sakula persistence rat trojan

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  91490bff054fa248fd40f33cd7b5cd7c06b56b0d61fbacea4f55f20444042bcf
- Size
  
  79KB
- MD5
  
  549231ffdfd99eee6ed23542d0876b70
- SHA1
  
  df18c69fdef7bf0f01c0128c78cf6725d37d049d
- SHA256
  
  91490bff054fa248fd40f33cd7b5cd7c06b56b0d61fbacea4f55f20444042bcf
- SHA512
  
  d3ea472ef9d1da543fd23f6bf419a98100f38341871fded2a5ed71d3d8216f23b3474ecac7a174a0e8bae4c8c80a4ce2dc97171389a50518fb2cc71025ddb05c
- SSDEEP
  
  1536:MSoaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtro9:M90hpgz6xGhTjwHN30BE9
Score

10^/10

sakula persistence rat trojan
- Sakula
  Sakula is a remote access trojan with various capabilities.
  trojan rat sakula
- Sakula payload
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

sakulapersistencerattrojan

behavioral2

sakulapersistencerattrojan

© 2018-2024

Terms | Privacy