Extracted

• • Target

    53b51b604df96818c12ed33e757aa7577a25ac80b1a1d54d7163193d40368598.exe

  • Size

    92KB

  • MD5

    e17206d585a4af6a7e3293c9d14fe4d7

  • SHA1

    33f68e28a66b35b94848d7e8cedce52ba62698c4

  • SHA256

    53b51b604df96818c12ed33e757aa7577a25ac80b1a1d54d7163193d40368598

  • SHA512

    e796b51732ed656a62e5af9d8364cc1bfa4cf063df5fe79594a5882a0423296c9de5b4ec489e40c953f0852287db67f08c29f7bde7949a3d1432b9cb4311a43f

  • SSDEEP

    1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtre:9bfVk29te2jqxCEtg30BC

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2