Extracted

• • Target

    c893ce32e420e4667034d7e65be8a3274a7b4a39044b08973c5725d43b0b8822N.exe

  • Size

    92KB

  • MD5

    0969cf479a6327110d734a8a66ba0700

  • SHA1

    43ff0722e5119ac723afabf73f6d7eec5f875025

  • SHA256

    c893ce32e420e4667034d7e65be8a3274a7b4a39044b08973c5725d43b0b8822

  • SHA512

    f0ca4f454298989527aa8c6c0fda8589aef332eb687ada84b6dec5509b41e49be67347d6160254217973c82572dd95a7c5bda9f8d3db42f357a30ffa98057d21

  • SSDEEP

    1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrm:9bfVk29te2jqxCEtg30Bi

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2