Extracted

• • Target

    b85d0b465dca98653a4c5faddc4d77ab34f702213ab16597b3586595b737cbf5.exe

  • Size

    92KB

  • MD5

    745a5971743038bdab98274e18231d9d

  • SHA1

    4bba06b5ddb4ad3437da891a55da4f20a85b9421

  • SHA256

    b85d0b465dca98653a4c5faddc4d77ab34f702213ab16597b3586595b737cbf5

  • SHA512

    071ab440621d096f457349891f9826b643eab5be482b9da58fc0620533be67e53199664e0c82505ab9dbe10fe3e172e9380b9d512f066b4818b35570794cc547

  • SSDEEP

    1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrt:9bfVk29te2jqxCEtg30BZ

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2