Extracted

• • Target
    d8ef2a8d6a5be2ee473cfffc9ff2caf8f8e7d31c8f9f228174e5bd8c3544bbf6
  • Size 101KB
  • SHA256 d8ef2a8d6a5be2ee473cfffc9ff2caf8f8e7d31c8f9f228174e5bd8c3544bbf6
  • MD5 5d49673181ec2ef4326a832426b09a4b
  • SHA1 447ae72d5a418f738d33d9840d39418ef145550c
  • SHA512 945ca2ce8c5c769fbfa9e0ebffa5f27158d84518241929962a1387b0e56299a35632e99a312152659774bdb809ca4065c6643dc97b92b83e258b7aeaeb4dfa32
  • SSDEEP 1536:zJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrXv/z:dbfVk29te2jqxCEtg30BP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  sakulapersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2