Overview

overview

10

Static

static

3

NEAS.7dfa5...d0.exe

windows7-x64

10

NEAS.7dfa5...d0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe

  • Size

    37KB

  • Sample

    231102-t9ehtshc2t

  • MD5

    7dfa5969ae27a365a060e56dc2c754d0

  • SHA1

    945514605413723102044eb1a5ad5fb279e4f075

  • SHA256

    a868366cdfed0187dac2c742006dde066183baea49f4401289d24a3589d3b64e

  • SHA512

    0863c4ef05b5fbcd7c4caf3a691a01211397f2bfd9cd22fda54d88e31c97284c34f4ff197921e75ff31f8fc311d341e6c2e1b3164e25f17a76a70e2aad10b09c

  • SSDEEP

    768:D7Xezc/T6Zp14hyYtoVxYF9mH8VQ1PcPW/M9zU:n6zqhyYtkYWRPTEzU

Score
10/10
sakulapersistencerattrojan

Malware Config

Extracted

Family

sakula

C2

http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d

http://www.we11point.com:443/photo/%s.jpg?vid=%d

Targets

    • Target

      NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe

    • Size

      37KB

    • MD5

      7dfa5969ae27a365a060e56dc2c754d0

    • SHA1

      945514605413723102044eb1a5ad5fb279e4f075

    • SHA256

      a868366cdfed0187dac2c742006dde066183baea49f4401289d24a3589d3b64e

    • SHA512

      0863c4ef05b5fbcd7c4caf3a691a01211397f2bfd9cd22fda54d88e31c97284c34f4ff197921e75ff31f8fc311d341e6c2e1b3164e25f17a76a70e2aad10b09c

    • SSDEEP

      768:D7Xezc/T6Zp14hyYtoVxYF9mH8VQ1PcPW/M9zU:n6zqhyYtkYWRPTEzU

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks