Extracted

• • Target

    Trojan.Win32.Cerber.pz-ef9ec5a25ec47604da16e37dea41e9f2505e491594453dd001e2d3c8de003b86N

  • Size

    64KB

  • MD5

    fd58bac64f8994e1f544398103039220

  • SHA1

    6282fc1c361446df7db7b79ab825a06508c27ae6

  • SHA256

    ef9ec5a25ec47604da16e37dea41e9f2505e491594453dd001e2d3c8de003b86

  • SHA512

    7bd0b654b394032c464920925be4bdc0ae7b9cdf2c5d73fd880808d2551be8141a3af04daf872d6f383dd4108d087965262fe1bddf04ba7d17ab7d2c5ff470ad

  • SSDEEP

    768:Y0gD04rmpLAuJGlfAHI9lqnP8q0gXg0uvsVWZz/L4i/ym23ysRaKFt9kS3DCkeIt:YNpmpkzAHkq0gXgffZgiKKsDNDCkruE

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2