Overview

overview

10

Static

static

3

NEAS.e22fd...60.exe

windows7-x64

10

NEAS.e22fd...60.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.e22fd557446fc4db192f2a59a63b9060.exe

  • Size

    42KB

  • Sample

    231103-qtmmqabb7t

  • MD5

    e22fd557446fc4db192f2a59a63b9060

  • SHA1

    5d4284f1c17c4b8641314d8ff7168bf9e2def1de

  • SHA256

    e408146553434256c29bbf21c01eb51c925dc2b9e0cfa6c1adaa0bda9c7deb04

  • SHA512

    7259157ea442911f23c27cc1f9141fbfab70877516a8eb108debb61de01efc53b2ef26104761782ddcb47ba29bf660b1f0a312eba284bf23fc6dbed4ff2c8c83

  • SSDEEP

    768:KhSksandb4GgyMsp4hyYtoVxYGm1oUt1vnhB+G:KTsGpehyYtkYvyUFsG

Score
10/10
sakulapersistencerattrojan

Malware Config

Extracted

Family

sakula

C2

http://vpn.premrera.com:443/viewpre.asp?cstring=%s&tom=%d&id=%d

http://vpn.premrera.com:443/photo/%s.jpg?id=%d

http://173.254.226.212:443/viewpre.asp?cstring=%s&tom=%d&id=%d

http://173.254.226.212:443/photo/%s.jpg?id=%d

Targets

    • Target

      NEAS.e22fd557446fc4db192f2a59a63b9060.exe

    • Size

      42KB

    • MD5

      e22fd557446fc4db192f2a59a63b9060

    • SHA1

      5d4284f1c17c4b8641314d8ff7168bf9e2def1de

    • SHA256

      e408146553434256c29bbf21c01eb51c925dc2b9e0cfa6c1adaa0bda9c7deb04

    • SHA512

      7259157ea442911f23c27cc1f9141fbfab70877516a8eb108debb61de01efc53b2ef26104761782ddcb47ba29bf660b1f0a312eba284bf23fc6dbed4ff2c8c83

    • SSDEEP

      768:KhSksandb4GgyMsp4hyYtoVxYGm1oUt1vnhB+G:KTsGpehyYtkYvyUFsG

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks