Overview

overview

10

Static

static

3

2f9587beab...47.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2f9587beab6f18ccf6dfbba33f6923aed82eb6639973b76ffd757c91d2426847

  • Size

    48KB

  • Sample

    250412-1twwhastct

  • MD5

    06b8ec3185faccd56aa2680267c25793

  • SHA1

    1309feb6d5238ce23114f565b4f679bf38cbd83e

  • SHA256

    2f9587beab6f18ccf6dfbba33f6923aed82eb6639973b76ffd757c91d2426847

  • SHA512

    f6410b7335c60ff9a0223341003e16d23f121ddc6f18c5286e1c9660c9fcf81e1777ff186e53a43f59bfa510ae05e4d68385df8bfac6667de21e27bad0dd73a1

  • SSDEEP

    768:RaSCio6y6y/FCBJTAIO3OtYVUPsED3VK2+ZtyOjgO4r9vFAg2rqO:5w6y/FCPnO3sYTjipvF2Z

Score
10/10
sakuladiscoverypersistencerattrojan

Malware Config

Extracted

Family

sakula

C2

http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d

http://www.we11point.com:443/photo/%s.jpg?vid=%d

Targets

    • Target

      2f9587beab6f18ccf6dfbba33f6923aed82eb6639973b76ffd757c91d2426847

    • Size

      48KB

    • MD5

      06b8ec3185faccd56aa2680267c25793

    • SHA1

      1309feb6d5238ce23114f565b4f679bf38cbd83e

    • SHA256

      2f9587beab6f18ccf6dfbba33f6923aed82eb6639973b76ffd757c91d2426847

    • SHA512

      f6410b7335c60ff9a0223341003e16d23f121ddc6f18c5286e1c9660c9fcf81e1777ff186e53a43f59bfa510ae05e4d68385df8bfac6667de21e27bad0dd73a1

    • SSDEEP

      768:RaSCio6y6y/FCBJTAIO3OtYVUPsED3VK2+ZtyOjgO4r9vFAg2rqO:5w6y/FCPnO3sYTjipvF2Z

    Score
    10/10
    sakuladiscoverypersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula family

      sakula

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks