Extracted

• • Target
    96f24448c98b1d052dd2090768692910_NEIKI
  • Size 221KB
  • SHA256 556454e21303324c08a0c2236d2d8262300e44473116edb3c91c6347ef0d5acb
  • MD5 96f24448c98b1d052dd2090768692910
  • SHA1 31f2e1f9bd66ef69e1a93d9a72f6039e216db26d
  • SHA512 c45d755fb27614aa0fc75e8172f432d29b4df3c9c711ca2a46751a449d0cc2bfabb8a367fdf8288d026ac661b193fbe863433252bc9d2987d0c390d5130b0d5d
  • SSDEEP 3072:uPPUj3+5FMIn8To94wa7uZwOuz/xS3iGpZMhDEXzkOSUUKeF8a7bXxBgW4gfw9V:uUC5TUm4wZwBxE1+ijiBKZ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  sakulapersistencerattrojanupx

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2