Overview

overview

10

Static

static

3

NEAS.ec345...00.exe

windows7-x64

10

NEAS.ec345...00.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.ec345be9d2794737fcfe1aa1c146ca00.exe

  • Size

    64KB

  • Sample

    231111-e59e3sae5w

  • MD5

    ec345be9d2794737fcfe1aa1c146ca00

  • SHA1

    0698a3a66061066d67be0721c1f204a1b0efd1fc

  • SHA256

    1e0c552ef01c5efea7c317a864b31b63fdd73b5651e1f3f268dc7a8f7a8205b5

  • SHA512

    015a589c4fb3e846152a3219843bcbf0693998633c9fa058b74794b11d250d69c607c49165e3a78da891e2349ef2283b2fad248339f6fe16c2d718bc64cb80af

  • SSDEEP

    768:Y0gD04rmpLAuJGlfAHI9lqnP8q0gXg0uvsVWZz/L4i/ym23ysRaKFt9kS3DCkeID:YNpmpkzAHkq0gXgffZgiKKsDNDCkruy

Score
10/10
sakulapersistencerattrojan

Malware Config

Extracted

Family

sakula

C2

www.polarroute.com

Targets

    • Target

      NEAS.ec345be9d2794737fcfe1aa1c146ca00.exe

    • Size

      64KB

    • MD5

      ec345be9d2794737fcfe1aa1c146ca00

    • SHA1

      0698a3a66061066d67be0721c1f204a1b0efd1fc

    • SHA256

      1e0c552ef01c5efea7c317a864b31b63fdd73b5651e1f3f268dc7a8f7a8205b5

    • SHA512

      015a589c4fb3e846152a3219843bcbf0693998633c9fa058b74794b11d250d69c607c49165e3a78da891e2349ef2283b2fad248339f6fe16c2d718bc64cb80af

    • SSDEEP

      768:Y0gD04rmpLAuJGlfAHI9lqnP8q0gXg0uvsVWZz/L4i/ym23ysRaKFt9kS3DCkeID:YNpmpkzAHkq0gXgffZgiKKsDNDCkruy

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks