Extracted

• • Target
    2770111e9c78bdad80466d60982f0d3f576e051dc8c566d504a1c59cce0a33d0
  • Size 150KB
  • SHA256 2770111e9c78bdad80466d60982f0d3f576e051dc8c566d504a1c59cce0a33d0
  • MD5 6e092b58c6215f860f0255f3fb5f2f83
  • SHA1 3bb49785892deafff5c8ee6b05c95aa17466d3f2
  • SHA512 2547341fe729b7b9344b65c9b093ab067fd9b0f7108a9d5c2f94724ddd7a09998f95185b65b5edfc6f3cd160f05332c89b870ca89ce9d5c1372f406855468a1a
  • SSDEEP 3072:H29DkEGRQixVSjLLJ30BWPOt5dQw+hyuGDInwM:H29qRfVSnt30Bbt+IhDFM
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2