Extracted

• • Target

    dfd1856323cba7485217cee5c5c8f48f_JC.exe

  • Size

    92KB

  • MD5

    dfd1856323cba7485217cee5c5c8f48f

  • SHA1

    cddf93ff37818ebf3ec1f36939a47591c7fac798

  • SHA256

    e67eeb117157e80b07099997f130125100ff35cc44712e54f1842a26e89d5050

  • SHA512

    b0ccc4e9e2690c855309c4277b198940e839c64c94d0f3b9eabdacb2deb41be37498b6efc91d8e5e3215e74f23baeba3b378c3ecf64387f8da66b4137345bcc2

  • SSDEEP

    1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrC:9bfVk29te2jqxCEtg30BG

  Score

  10^/10

  sakulapersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2