Overview

overview

10

Static

static

10

NEAS.abb06...a0.exe

windows7-x64

10

NEAS.abb06...a0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.abb06b82203edc953c2b016ef0772fa0.exe

  • Size

    92KB

  • Sample

    231022-vzprgshg26

  • MD5

    abb06b82203edc953c2b016ef0772fa0

  • SHA1

    57088d9cad61c4735721d1361b54b266d8e221c6

  • SHA256

    5457ca1d9bec31822e28c7369b930e1f78a9c6f9ab727f493a0216230b22abe7

  • SHA512

    d2389e85e841cf8067b05a3a434ca20655a7cc6f621983bd0bb5c381b7b1dfddd623d3f9e61d18d1e65ae82a4de5f5bce0f9fd29807ccafffad7b70b52ed987b

  • SSDEEP

    1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtr4:9bfVk29te2jqxCEtg30BE

Score
10/10
sakulapersistencerattrojan

Malware Config

Extracted

Family

sakula

C2

www.savmpet.com

Targets

    • Target

      NEAS.abb06b82203edc953c2b016ef0772fa0.exe

    • Size

      92KB

    • MD5

      abb06b82203edc953c2b016ef0772fa0

    • SHA1

      57088d9cad61c4735721d1361b54b266d8e221c6

    • SHA256

      5457ca1d9bec31822e28c7369b930e1f78a9c6f9ab727f493a0216230b22abe7

    • SHA512

      d2389e85e841cf8067b05a3a434ca20655a7cc6f621983bd0bb5c381b7b1dfddd623d3f9e61d18d1e65ae82a4de5f5bce0f9fd29807ccafffad7b70b52ed987b

    • SSDEEP

      1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtr4:9bfVk29te2jqxCEtg30BE

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks