Overview

overview

10

Static

static

3

NEAS.fa6f2...90.exe

windows7-x64

10

NEAS.fa6f2...90.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.fa6f2a81cfe58c75464b718232600590.exe

  • Size

    37KB

  • Sample

    231110-yfzzwsdd3v

  • MD5

    fa6f2a81cfe58c75464b718232600590

  • SHA1

    76593acd52de4f0e82afffaa801d710f5582b22a

  • SHA256

    26be8a8d061e3681dca81b85fe8421e2dcf114fb74f1c4963d75686e16be846e

  • SHA512

    90f7e9f6f04dbaf8112a33caeedc55ca3c87f7c76042ad484b26be2c6a3813e95c3cc5d783ee01625e15234356001e168acd0e9412db45456da9c3ad212da4bc

  • SSDEEP

    768:D7Xezc/T6Zp14hyYtoVxYF9mH8VQ1PcPW/M9zJ:n6zqhyYtkYWRPTEzJ

Score
10/10
sakulapersistencerattrojan

Malware Config

Extracted

Family

sakula

C2

http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d

http://www.we11point.com:443/photo/%s.jpg?vid=%d

Targets

    • Target

      NEAS.fa6f2a81cfe58c75464b718232600590.exe

    • Size

      37KB

    • MD5

      fa6f2a81cfe58c75464b718232600590

    • SHA1

      76593acd52de4f0e82afffaa801d710f5582b22a

    • SHA256

      26be8a8d061e3681dca81b85fe8421e2dcf114fb74f1c4963d75686e16be846e

    • SHA512

      90f7e9f6f04dbaf8112a33caeedc55ca3c87f7c76042ad484b26be2c6a3813e95c3cc5d783ee01625e15234356001e168acd0e9412db45456da9c3ad212da4bc

    • SSDEEP

      768:D7Xezc/T6Zp14hyYtoVxYF9mH8VQ1PcPW/M9zJ:n6zqhyYtkYWRPTEzJ

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks