Extracted

• • Target
    51006b322218e210fa5c4d0a98af33f0_NeikiAnalytics
  • Size 101KB
  • SHA256 b73cf65a36ffae4d6177a7db56333529563710e8693a8455d70fb847cb46fc5d
  • MD5 51006b322218e210fa5c4d0a98af33f0
  • SHA1 ea40faa220598c103957ec9f7b0896753a4f30d9
  • SHA512 1333ea5f7028034d17d0f083c792d43fb94edc1a04be81332457aeba18034b0d761af7ff66796921a42824e71fc5feee223902c3f8af782604071839192487c8
  • SSDEEP 1536:zJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrXv/f:dbfVk29te2jqxCEtg30BD
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  sakulapersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2