Extracted

• • Target

    afc325e17a09acb994a728a5c3ee4d40538cb0d23b5534f83efc9fd8cb4145e4N.exe

  • Size

    168KB

  • MD5

    5d1f3f5b7d83a9e8ec838130859c5fd0

  • SHA1

    3be15daf51747a489cf7258dedb1066e7446505f

  • SHA256

    afc325e17a09acb994a728a5c3ee4d40538cb0d23b5534f83efc9fd8cb4145e4

  • SHA512

    c98295ab37b6afc196ce4290bb35be10d8b355b04ec835a4da5b2d629a2afd9905f0f40d52d7e2e55cf1ccbadfb7ed67edf096103e635871ca8fceb59bd86517

  • SSDEEP

    3072:M29DkEGRQixVSjLwes5G30Bg7uZwOuz/xS3iGpZMK:M29qRfVSndj30B3wBxE1+K

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2