Overview

overview

10

Static

static

3

NEAS.e4270...JC.exe

windows7-x64

10

NEAS.e4270...JC.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.e42707361ceac2810fca458d710ed970_JC.exe

  • Size

    19KB

  • Sample

    231031-w6eersed53

  • MD5

    e42707361ceac2810fca458d710ed970

  • SHA1

    5b06f40bf905b6a9e460ec6584a1bd50fa656f40

  • SHA256

    467128faa49236b0b0c5479f4111a044c93b9e5c0b7ea42f7070cf771ee9ccba

  • SHA512

    e3f6db7a01cbe52e070d279d94e0f74e15f65daf85804b016095ef0aea6d2392863a16639d65d4f046877af40172079091255608ed56cc48d076bf9f06b6e281

  • SSDEEP

    384:xgGPsWP5yfakEqz2dUzOQv+riS9cs4sSFDBMRZ9TLdAeMi:8syik3CdUzOs+R9cFDBMt

Score
10/10
sakulapersistencerattrojan

Malware Config

Extracted

Family

sakula

C2

http://vpn.premrera.com:443/viewpre.asp?cstring=%s&tom=%d&id=%d

http://vpn.premrera.com:443/photo/%s.jpg?id=%d

http://173.254.226.212:443/viewpre.asp?cstring=%s&tom=%d&id=%d

http://173.254.226.212:443/photo/%s.jpg?id=%d

Targets

    • Target

      NEAS.e42707361ceac2810fca458d710ed970_JC.exe

    • Size

      19KB

    • MD5

      e42707361ceac2810fca458d710ed970

    • SHA1

      5b06f40bf905b6a9e460ec6584a1bd50fa656f40

    • SHA256

      467128faa49236b0b0c5479f4111a044c93b9e5c0b7ea42f7070cf771ee9ccba

    • SHA512

      e3f6db7a01cbe52e070d279d94e0f74e15f65daf85804b016095ef0aea6d2392863a16639d65d4f046877af40172079091255608ed56cc48d076bf9f06b6e281

    • SSDEEP

      384:xgGPsWP5yfakEqz2dUzOQv+riS9cs4sSFDBMRZ9TLdAeMi:8syik3CdUzOs+R9cFDBMt

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks