Extracted

• • Target

    44aff363646429325be5c3f8745a6750N.exe

  • Size

    39KB

  • MD5

    44aff363646429325be5c3f8745a6750

  • SHA1

    3d998719e90454331751c4057908862c876d8701

  • SHA256

    bb98ae1ad2131bd43ea983a32c7f95d7a17a647ab5b143aa2143e1eefd8fb682

  • SHA512

    d2161979a58c5f9bce92f28593522ea9c0db3cbc997780bc053117cced568b1d4db42c276a2b61607e8fa5dfa249bceaaee3f87fdc4142a4524cd99a26606ab0

  • SSDEEP

    768:EXgqefjKf3Z6qSRnzpdwT1RIj1egKRFXSp/Dfm982r7D7:QgqeGB6qAnzpdw5Y0wLm9hH

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2