Overview

overview

10

Static

static

3

5b5ae28e09...9d.exe

windows7-x64

10

5b5ae28e09...9d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5b5ae28e0981a245861a7472b03c06560dee19a9b1f229f7e6f9787e45070f9d

  • Size

    36KB

  • Sample

    230809-v9jyzsff4y

  • MD5

    7efce4367568e3646ce947eb0cae2087

  • SHA1

    2132274cf3f538ede3b6861cccc9c5e637245c1e

  • SHA256

    5b5ae28e0981a245861a7472b03c06560dee19a9b1f229f7e6f9787e45070f9d

  • SHA512

    e5c86424ad60e40943f3d47b918c50972ca555c3bff69d8fc2b89389ac952bfeb8dc4c58fc6bbccee404f854d9d2657bcfaa9bf23cb3c20ab87371b956d20c9e

  • SSDEEP

    768:TwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv2647Dg:TwbYP4nuEApQK4TQbtY2gA9DX+ytBOS

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      5b5ae28e0981a245861a7472b03c06560dee19a9b1f229f7e6f9787e45070f9d

    • Size

      36KB

    • MD5

      7efce4367568e3646ce947eb0cae2087

    • SHA1

      2132274cf3f538ede3b6861cccc9c5e637245c1e

    • SHA256

      5b5ae28e0981a245861a7472b03c06560dee19a9b1f229f7e6f9787e45070f9d

    • SHA512

      e5c86424ad60e40943f3d47b918c50972ca555c3bff69d8fc2b89389ac952bfeb8dc4c58fc6bbccee404f854d9d2657bcfaa9bf23cb3c20ab87371b956d20c9e

    • SSDEEP

      768:TwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv2647Dg:TwbYP4nuEApQK4TQbtY2gA9DX+ytBOS

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula payload

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks