Extracted

• • Target

    50fbab781baebc5fa2728276289e5ef2de2ee1d1ae8bdc213ababc6d242ca603

  • Size

    101KB

  • MD5

    ebb8d4e884bbb7176ad3e5596ceee5f0

  • SHA1

    8937fa9e58d71c561b0d7a2ad31fb777808cc516

  • SHA256

    50fbab781baebc5fa2728276289e5ef2de2ee1d1ae8bdc213ababc6d242ca603

  • SHA512

    198eee512cdfa8b03e88a642e9412f919fc1c94fdac15aba7810482381136e35e923f0625e5742665a9729c1448cadb405dc9ec8b6b0a2e93bc4a86836c539cf

  • SSDEEP

    1536:9JbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrGPTEz4:/bfVk29te2jqxCEtg30BibEc

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2