Extracted

• • Target

    f4b1a0c10745d3b59e9a3366c45a1aab399f407b5a541e01ca00e147ad841a62.exe

  • Size

    92KB

  • MD5

    4123f91c43c94172a34671fc9d2a4ce1

  • SHA1

    b0acc1b11837002b80044658c33fb29baa49a8fc

  • SHA256

    f4b1a0c10745d3b59e9a3366c45a1aab399f407b5a541e01ca00e147ad841a62

  • SHA512

    24ce2eff369b5239fa1d6df489b2e15522569cb94b36ce05ec3fd0e2f10374ccf2cf46c5fe7872cbd31eefd10ab05f68d90f305f472a1a5b6199679375909e3d

  • SSDEEP

    1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrU:9bfVk29te2jqxCEtg30BA

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2