Extracted

• • Target

    2770111e9c78bdad80466d60982f0d3f576e051dc8c566d504a1c59cce0a33d0

  • Size

    150KB

  • MD5

    6e092b58c6215f860f0255f3fb5f2f83

  • SHA1

    3bb49785892deafff5c8ee6b05c95aa17466d3f2

  • SHA256

    2770111e9c78bdad80466d60982f0d3f576e051dc8c566d504a1c59cce0a33d0

  • SHA512

    2547341fe729b7b9344b65c9b093ab067fd9b0f7108a9d5c2f94724ddd7a09998f95185b65b5edfc6f3cd160f05332c89b870ca89ce9d5c1372f406855468a1a

  • SSDEEP

    3072:H29DkEGRQixVSjLLJ30BWPOt5dQw+hyuGDInwM:H29qRfVSnt30Bbt+IhDFM

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2