Extracted

• • Target

    3465921fb3b042e2964e1c0443b34e95206b9d748c5b3dcf403edbf1edf6db60.exe

  • Size

    92KB

  • MD5

    f06649c5c74275b9732e0645f213c461

  • SHA1

    42351de6f859ecef5a86593391a0bf4f0e474c15

  • SHA256

    3465921fb3b042e2964e1c0443b34e95206b9d748c5b3dcf403edbf1edf6db60

  • SHA512

    798a049d06e4095793ad26e7aaea3a90c8a220b8a0785cb8d7f96ee279007e0b6769e9c6545ef1d2c18ed8802412b2a7d0f2d6d10e400ada9f09ecbd044d4f25

  • SSDEEP

    1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtr5:9bfVk29te2jqxCEtg30Bd

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2