Overview

overview

10

Static

static

3

NEAS.89832...a0.exe

windows7-x64

10

NEAS.89832...a0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.89832a7f0f4798e0b28bb43e54a70aa0.exe

  • Size

    256KB

  • Sample

    231022-vx6xzsgf84

  • MD5

    89832a7f0f4798e0b28bb43e54a70aa0

  • SHA1

    c9f0647b7c062183e617b552c69b34d76c40013f

  • SHA256

    ad73530fe5b6e5da26767221bf65acb87fc4a76fcb95286f746d091975d1f15c

  • SHA512

    3ce54ca0e3f293f2264731bdbbaf67832ab1670cb2a5f075bfbd05c7f3f1ec484fe91241a8dff5af9abb771d20ea737c1ebc02b7e831778685727da301693fcd

  • SSDEEP

    6144:rHkZeUwBxE1+ijiBKk3etdgI2MyzNORQtOfl1qNVo7R+S+N/k:TkZbw8EYiBlg

Score
10/10
sakulapersistencerattrojan

Malware Config

Extracted

Family

sakula

C2

www.polarroute.com

Targets

    • Target

      NEAS.89832a7f0f4798e0b28bb43e54a70aa0.exe

    • Size

      256KB

    • MD5

      89832a7f0f4798e0b28bb43e54a70aa0

    • SHA1

      c9f0647b7c062183e617b552c69b34d76c40013f

    • SHA256

      ad73530fe5b6e5da26767221bf65acb87fc4a76fcb95286f746d091975d1f15c

    • SHA512

      3ce54ca0e3f293f2264731bdbbaf67832ab1670cb2a5f075bfbd05c7f3f1ec484fe91241a8dff5af9abb771d20ea737c1ebc02b7e831778685727da301693fcd

    • SSDEEP

      6144:rHkZeUwBxE1+ijiBKk3etdgI2MyzNORQtOfl1qNVo7R+S+N/k:TkZbw8EYiBlg

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks