Extracted

• • Target

    5b0384d28a1fac07ef494979892a4f0057053545d8ea2d47bdc957e5c3f48c5e.exe

  • Size

    92KB

  • MD5

    1f2e9f34d8b69db4ee47fbf68c2b6028

  • SHA1

    6b1a794d0972bfd1f934c9043fa16dd4c169ea3c

  • SHA256

    5b0384d28a1fac07ef494979892a4f0057053545d8ea2d47bdc957e5c3f48c5e

  • SHA512

    ea6c820bbe54aaabbd81ece8b6448ebf50aecab3ee2a7d0b4ae062467fdce2adc63b02089df5c8d8a957922fc1d9378081c8a5a63741c3d17cf0f86219afce76

  • SSDEEP

    1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtri:9bfVk29te2jqxCEtg30B2

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2