Overview

overview

10

Static

static

10

NEAS.f924c...c0.exe

windows7-x64

10

NEAS.f924c...c0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.f924cfab54736ef8f590a966dc99dbc0.exe

  • Size

    92KB

  • Sample

    231101-bhsx2agd61

  • MD5

    f924cfab54736ef8f590a966dc99dbc0

  • SHA1

    b15e067c508ce804936bd75233f59c29320a62b4

  • SHA256

    8c31ef5fc7051b47e6f00f3c307abc02c0725c9061a7f8b2e570931d6e60ed29

  • SHA512

    4ba35fd8935a75c623c55dee6a449f314c94348880cd9b90e539cb7d1e1f6f1d784a9f2bcd6c1eb42e97577ce676e951be3ac963f6a316b011530aca4475b9c6

  • SSDEEP

    1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrh:9bfVk29te2jqxCEtg30BV

Score
10/10
sakulapersistencerattrojan

Malware Config

Extracted

Family

sakula

C2

www.savmpet.com

Targets

    • Target

      NEAS.f924cfab54736ef8f590a966dc99dbc0.exe

    • Size

      92KB

    • MD5

      f924cfab54736ef8f590a966dc99dbc0

    • SHA1

      b15e067c508ce804936bd75233f59c29320a62b4

    • SHA256

      8c31ef5fc7051b47e6f00f3c307abc02c0725c9061a7f8b2e570931d6e60ed29

    • SHA512

      4ba35fd8935a75c623c55dee6a449f314c94348880cd9b90e539cb7d1e1f6f1d784a9f2bcd6c1eb42e97577ce676e951be3ac963f6a316b011530aca4475b9c6

    • SSDEEP

      1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrh:9bfVk29te2jqxCEtg30BV

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks