Extracted

• • Target

    b20523514390d3423b0e225c5323726e9cecf4a2fe3d0839500aa30979bae9abN.exe

  • Size

    92KB

  • MD5

    0367b8274f39649c2923cc17df406e50

  • SHA1

    2efa1cddfb77f5617147d5c91d777845bd5167e2

  • SHA256

    b20523514390d3423b0e225c5323726e9cecf4a2fe3d0839500aa30979bae9ab

  • SHA512

    93ea3bd2b555bfab311b9fda665948cf79d2a3a1ccdfbf64e7d9416b5a41f2c84289cca6f15dc2d83ab8ff7b0c157e5dfd8fc89fc2f3925d703d93c07ba0defc

  • SSDEEP

    1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrK:9bfVk29te2jqxCEtg30BW

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2