Extracted

• • Target

    a601c8375a61908e22ec9d8f50e24a838c717b635cc39144f12aef34de10221d

  • Size

    517KB

  • MD5

    27a929c376221c72dae86152bb970efd

  • SHA1

    2c53d1f801645d7cc59d5632926a45c0ecbade45

  • SHA256

    a601c8375a61908e22ec9d8f50e24a838c717b635cc39144f12aef34de10221d

  • SHA512

    10c56d07be32afe14c6ccba3c65465632ee5748ed337d89240b49a6a559ae4b622d43242acae494b6e3f9002756b557684cb6efb1c543fa1f93508e62fa01811

  • SSDEEP

    12288:0RfQn+w8EYiBlMkn5f9J105ko8T6csVeU:g4+wlYBsb3zNsh

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2