Extracted

• • Target

    3f1f939543ecb3feefcfb57044ed1cff6131f0f409b0de93720d2721f2903a3e.exe

  • Size

    105KB

  • MD5

    e4613537d468e369e3ba9918e8c85caa

  • SHA1

    758576f401b5ef0826aa0112edf6ae25460e98d1

  • SHA256

    3f1f939543ecb3feefcfb57044ed1cff6131f0f409b0de93720d2721f2903a3e

  • SHA512

    5fbe9fcc20d45af8978cbd891a6d96ff3db547f0446f46e89e626ae6d2f12f2a746638a9e1e1fc46905dba1b7fa2c7b77d1deaec75aa8aabe58f8be4e97f3518

  • SSDEEP

    1536:anRw3vN6mG1y8nRB8aX3DVwd4sSH2/fTMLkKFTeUCD+xFOOf4EVRMLfsU9:aCv48aHDCz/LUkwedD+MLfsg

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2