Extracted

• • Target
    d21968793fc460ff13c7ce61fa95cd40_NEIKI
  • Size 101KB
  • SHA256 8708f6d7e7a8a95b8ca5c7d2c033d57a9c1bccdb93561a1cdbab61880ddcf52d
  • MD5 d21968793fc460ff13c7ce61fa95cd40
  • SHA1 9d340efced1c17758181970b6012caedf3c3cdaf
  • SHA512 5d636f65b7dff2545be288d70252ff2341d36b75048491a69cb39ededf4b5089db6af61dbc512199a71a626e73f3c3d1f0199e70162105a0d5468f404acdf154
  • SSDEEP 1536:9JbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrfPTEzK:/bfVk29te2jqxCEtg30BLbEW
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  sakulapersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2