Extracted

• • Target

    ee4a9101cb59fe9501f057d2fe01c610a9000329cbc58dcde3124cd0c99444ca

  • Size

    102KB

  • MD5

    53c056896b066b84819044bfe712e9b3

  • SHA1

    ee35e75cba24ce8bd1fedb0c3b8024abcf600b66

  • SHA256

    ee4a9101cb59fe9501f057d2fe01c610a9000329cbc58dcde3124cd0c99444ca

  • SHA512

    788a1e0fb622bd9d4b4a284fa575d21be6351d47236cef63fe90fd9f0610a6bc9996aa34f4940d6a25a7016f3730bc5cd30ee182e8757cb396550a8815ba1f2f

  • SSDEEP

    1536:jJbCiJVkgMaT2itTkjoRXnM48dXFajVPkPLnlxsz30rtrQ39r:tbfVk29te2juPLlxo30Bs39r

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2