Extracted

• • Target

    559e7fd2d4ffcf8ea257958066a8912bc859e8fc808e9c3581e95c89ea37e099.exe

  • Size

    92KB

  • MD5

    46876e70a07a4b14a15f3f469f8b43c3

  • SHA1

    d5c389ee6ebabe3650e29f67f9aea3a2d8144a34

  • SHA256

    559e7fd2d4ffcf8ea257958066a8912bc859e8fc808e9c3581e95c89ea37e099

  • SHA512

    28bfca4bd852f69a042e5c379a15edd3d9ecc7ece0f17b158ea0b85d3b220c4aa7640e5eab6a669e199e2a6173b896050ca1c8161ec865514c06a81338915167

  • SSDEEP

    1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrU:9bfVk29te2jqxCEtg30Bo

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2