Overview

overview

10

Static

static

3

NEAS.f5722...50.exe

windows7-x64

10

NEAS.f5722...50.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.f57221068bf350b5139860fa859ea350.exe

  • Size

    37KB

  • Sample

    231022-v4t7rsah7t

  • MD5

    f57221068bf350b5139860fa859ea350

  • SHA1

    3d51a6a32f709934197d480ab2d3136cb5e2629f

  • SHA256

    a5394fc377a2f0e8f4260a40cb0a38f0a5b9e91466243e5e777ede07b65da2ab

  • SHA512

    13e97b64d4a970100e64f55dd18d6a1bff5969d57945c136a296cbe7b3c925bbab170919454decf19bb802274d9324c56e00fc24ca49f340cc43cbce0aebdd4f

  • SSDEEP

    768:D7Xezc/T6Zp14hyYtoVxYF9mH8VQ1PcPW/M9zx:n6zqhyYtkYWRPTEzx

Score
10/10
sakulapersistencerattrojan

Malware Config

Extracted

Family

sakula

C2

http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d

http://www.we11point.com:443/photo/%s.jpg?vid=%d

Targets

    • Target

      NEAS.f57221068bf350b5139860fa859ea350.exe

    • Size

      37KB

    • MD5

      f57221068bf350b5139860fa859ea350

    • SHA1

      3d51a6a32f709934197d480ab2d3136cb5e2629f

    • SHA256

      a5394fc377a2f0e8f4260a40cb0a38f0a5b9e91466243e5e777ede07b65da2ab

    • SHA512

      13e97b64d4a970100e64f55dd18d6a1bff5969d57945c136a296cbe7b3c925bbab170919454decf19bb802274d9324c56e00fc24ca49f340cc43cbce0aebdd4f

    • SSDEEP

      768:D7Xezc/T6Zp14hyYtoVxYF9mH8VQ1PcPW/M9zx:n6zqhyYtkYWRPTEzx

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks