Extracted

• • Target

    efaf6b3da78cb5652deb0e1bc5ce41c0_JaffaCakes118

  • Size

    3.6MB

  • MD5

    efaf6b3da78cb5652deb0e1bc5ce41c0

  • SHA1

    8ee377ce62d6d0a0d984af18dee3dd4d6a09907c

  • SHA256

    e980ed54936d4fa9dc089bcddd17c7077eb8e1c59f6152fb9491ee9cca9854e9

  • SHA512

    4cf1055d8687eb90410b94626a74fda7eb58eeda9e01975c852fb94362aabaeef15f788abcc163bcd09c8956adcfc001a6066fd6364029b548c9066ac21fbfaf

  • SSDEEP

    49152:o852ZjeUNZZH46HsnHVT5ZA+acdD6xXTIs:oU6eUNZZJHsHm

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2