Extracted

• • Target

    995acf1535e99250c84e55149cd66b0e5d17fdd4cfe20408f9b09d32f264beb9N.exe

  • Size

    102KB

  • MD5

    a6d8bdd039c8ae93ef9215a3e371e7da

  • SHA1

    1a223de3b1143e0ccd722cfcae1b11945be8d9ca

  • SHA256

    0c77f38e48d8a180666eb7586627c2823a7feb94a8a9c60be5001ebc400bbd0e

  • SHA512

    2df3e4b6bce7102d10a413b60601eafe6e2e3cd8f6599db08e320537c4a3b68e0bf06f9afab2229d3353a69ddfd75c47dcff6d1d58c77c03ee1fe211b665e918

  • SSDEEP

    1536:jJbCiJVkgMaT2itTkjoRXnM48dXFajVPkPLnlxsz30rtrQ39z:tbfVk29te2juPLlxo30Bs39z

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2