Extracted

• • Target

    ebf23ac2a64b881d2b9d6b7a844476dd8f1907a2aa73f032aa9d6aa286227147

  • Size

    63KB

  • MD5

    2a13ce031540a0eb6231dbc005827373

  • SHA1

    bb4a93a1c4f6f0f8d226d42d6fe57874b9d29d6b

  • SHA256

    ebf23ac2a64b881d2b9d6b7a844476dd8f1907a2aa73f032aa9d6aa286227147

  • SHA512

    4ff8a8d84985a028340b37d997bb176e6325c5b9395ffecd5472d546aea57bc5bd587d3741c20c43fc32fb9df154ac0769a54b2748517d1ab74faf1c2eb78db0

  • SSDEEP

    1536:zoxBP0D61Oj3+5FdOa52C8pdo95j6hZ2MzNDCkrl:0PPUj3+5FMIn8To94wa7l

  Score

  10^/10

  sakulapersistencerattrojanupx

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula payload

  • UPX dump on OEP (original entry point)

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2