Extracted

• • Target

    ec78ca127cf207ac0b6e9e4f91ebf24ca2567077474eb41c752c3527a9a8eeed.exe

  • Size

    92KB

  • MD5

    f5db6bea19c2ada507640e09abc28950

  • SHA1

    7ec8ba8ecbb18e0b8751f85825d2e4b9bc203b8f

  • SHA256

    ec78ca127cf207ac0b6e9e4f91ebf24ca2567077474eb41c752c3527a9a8eeed

  • SHA512

    b317630c0d565cb239d7ed91ba6e36655d14116a05085996beea39fcbdf4666b84d56450fd78af2f809661ba894a6e8ef54738e36709dd94da6ffcab81d16afc

  • SSDEEP

    1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrn:9bfVk29te2jqxCEtg30BL

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2