Extracted

• • Target

    18a92d2c3353b7e1de84834655a00987_JC.exe

  • Size

    42KB

  • MD5

    18a92d2c3353b7e1de84834655a00987

  • SHA1

    961fca877600937d0cb74a1f191a4b9a94554345

  • SHA256

    5be17637b3e3a792a734fe6509d3c40a56218780c66f7f211ce5adfcd0921e56

  • SHA512

    3ad963c8b05e3343fb7ed8039610720c332bfc400f36952a4831b82debdc7e0da606cebb6452bddded5afcf1c9a6a255ae8bb9af7f40d64cab7e7a1fd28777e5

  • SSDEEP

    768:fvQB/z0pqrLoyT8I+E1j+KPPIYu8T0aTsJK56VO8XM0Wns+b2znpNqPP:fODhc+yBJW0WTU5XM1nJqjp0X

  Score

  10^/10

  sakulapersistencerattrojanupx

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2