Overview

overview

10

Static

static

3

c55ea932b9...bN.exe

windows7-x64

10

c55ea932b9...bN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c55ea932b99b57d61693ed3f80b0a0e87525369741d723910b1db202970a0cfbN

  • Size

    35KB

  • Sample

    241017-w5a1yssalk

  • MD5

    0d3d9d526a61a3e030b4615b3f96add0

  • SHA1

    b1f175aae098ea1ae723b3f6fa760b9943765b12

  • SHA256

    c55ea932b99b57d61693ed3f80b0a0e87525369741d723910b1db202970a0cfb

  • SHA512

    e28888002f721fb5da22e66507c8693be1a7b9cabc3c9c3d158c5aa10b5a4d45e89e9e308c2ac4810ce91c628c3f0ea5391a2b5caa6f685ab4fceaabf71fa160

  • SSDEEP

    768:qwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv2647Dp:qwbYP4nuEApQK4TQbtY2gA9DX+ytBOb

Score
10/10
sakuladiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      c55ea932b99b57d61693ed3f80b0a0e87525369741d723910b1db202970a0cfbN

    • Size

      35KB

    • MD5

      0d3d9d526a61a3e030b4615b3f96add0

    • SHA1

      b1f175aae098ea1ae723b3f6fa760b9943765b12

    • SHA256

      c55ea932b99b57d61693ed3f80b0a0e87525369741d723910b1db202970a0cfb

    • SHA512

      e28888002f721fb5da22e66507c8693be1a7b9cabc3c9c3d158c5aa10b5a4d45e89e9e308c2ac4810ce91c628c3f0ea5391a2b5caa6f685ab4fceaabf71fa160

    • SSDEEP

      768:qwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv2647Dp:qwbYP4nuEApQK4TQbtY2gA9DX+ytBOb

    Score
    10/10
    sakuladiscoverypersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks