Overview

overview

10

Static

static

3

NEAS.e1c22...e0.exe

windows7-x64

10

NEAS.e1c22...e0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.e1c2289916677c38e9adc385bb0361e0.exe

  • Size

    72KB

  • Sample

    231111-dm4ansgb9t

  • MD5

    e1c2289916677c38e9adc385bb0361e0

  • SHA1

    0d7e7a5e4b9eb3c9f06ff55d3f6de300f109a6b1

  • SHA256

    9da04acbfa0b64d3a456dd54d731edac905289980b7863cbe3dde4cdd457cd80

  • SHA512

    ddd23364ab50a06e1374368cc58c5a838c6885df357178bb78559dd17cfe8d847b67f0ee2149531f5c3972603c6d978d411d0dccdd0b938b828da262e2fc35bd

  • SSDEEP

    768:q7Xezc/T6Zp14hyYtoVxYF9mHfCBJTAIO3OtYVW6Qptwy1:G6zqhyYtkYW/CPnO3ajwy1

Score
10/10
sakulapersistencerattrojan

Malware Config

Extracted

Family

sakula

C2

http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d

http://www.we11point.com:443/photo/%s.jpg?vid=%d

Targets

    • Target

      NEAS.e1c2289916677c38e9adc385bb0361e0.exe

    • Size

      72KB

    • MD5

      e1c2289916677c38e9adc385bb0361e0

    • SHA1

      0d7e7a5e4b9eb3c9f06ff55d3f6de300f109a6b1

    • SHA256

      9da04acbfa0b64d3a456dd54d731edac905289980b7863cbe3dde4cdd457cd80

    • SHA512

      ddd23364ab50a06e1374368cc58c5a838c6885df357178bb78559dd17cfe8d847b67f0ee2149531f5c3972603c6d978d411d0dccdd0b938b828da262e2fc35bd

    • SSDEEP

      768:q7Xezc/T6Zp14hyYtoVxYF9mHfCBJTAIO3OtYVW6Qptwy1:G6zqhyYtkYW/CPnO3ajwy1

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks