Extracted

• • Target

    cf2cec6f6651ef15115d0cacd781ef60N

  • Size

    92KB

  • MD5

    cf2cec6f6651ef15115d0cacd781ef60

  • SHA1

    22fd12c2610045ce40b3e639b1c2d85dc0198a3b

  • SHA256

    6b3b9ae3ab46266fd8a9cb431d9dbee6a8722a128c478b15351bed2fd336fe2d

  • SHA512

    6b27b5061c866edc5fd46f308891c22a4b9fa2dbea9e8123bd0ac9f2385d5814c9071dfa3710c45c02fd277a2ce3d4bf22c6275589d2e902bedaa5ba711ed946

  • SSDEEP

    1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrQ:9bfVk29te2jqxCEtg30BM

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2