Extracted

• • Target

    afa2cacf38a097316c5db82395f5dcb2cc27561c2440ef2154713531e6d28264

  • Size

    102KB

  • MD5

    b5e3add51b26e1683f4db3bb101817ab

  • SHA1

    a9b9604079a46319e34411c353639f20b476e674

  • SHA256

    afa2cacf38a097316c5db82395f5dcb2cc27561c2440ef2154713531e6d28264

  • SHA512

    cfc86527f17be610780ba8f1346d377f3e9ce75821228be7d5ccd495beba91f5dc1f63ca7a8433061d3d4c5005bbfcb457f5827cbddc1ee690edcbbd634fbf62

  • SSDEEP

    1536:jJbCiJVkgMaT2itTkjoRXnM48dXFajVPkPLnlxsz30rtrQ39z:tbfVk29te2juPLlxo30Bs39z

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2