Extracted

• • Target
    7202973e034fa97cee62bc034fb13a15
  • Size 89KB
  • SHA256 7d609fdde3af560d4ca2f18921f0a4ec97c63960e503cc20890b571fc1578f95
  • MD5 7202973e034fa97cee62bc034fb13a15
  • SHA1 c00277d3840d0f4c246e60dab49d959326c06d9a
  • SHA512 efdd65a43bbb4e308f87b26b9d873503cf8633c68f8122876c0e1547ea1643c274ab7c52e4a280035a747923cb4e17f9e4d3c8ef4c58a1da35afeee93b17d621
  • SSDEEP 1536:lQFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX+ees52z30rtrg:e29DkEGRQixVSjLaes5G30BM
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  sakulapersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2