Extracted

• • Target
    b513e34939f4c8db1c0a0043aca5ee50
  • Size 304KB
  • SHA256 33c8ace830117c2b62deb9447d1319803cd82cf996213fd2dd7bb6c99933b346
  • MD5 b513e34939f4c8db1c0a0043aca5ee50
  • SHA1 204659586b81770e2e967ee13e7d43d2c61b377f
  • SHA512 81b7c0ab70ea0e630e9a85b39e5237b26efddc7098ebbc0acbcc16070b8d0e74383d4526c0c5cda0213f0f97c8a413abb01b3cf3169de2cde87bc8ca4ea456a9
  • SSDEEP 6144:M29qRfVSndj30B3wBxE1+ijiBKk3etdgI2MyzNORQtOfl1qNVo7R+S+N/B:0RfQn+w8EYiBld
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  sakulapersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2