Extracted

• • Target

    3a49d3416efc9717089425eb53d906d536d70ce77c7c5f5c8d3273ddc6dda5e1N.exe

  • Size

    63KB

  • MD5

    6d299113dc764e6c2e6cf84aeff88720

  • SHA1

    3c0455948a4d8bf05b894fde2d634131bd58bb88

  • SHA256

    3a49d3416efc9717089425eb53d906d536d70ce77c7c5f5c8d3273ddc6dda5e1

  • SHA512

    97de8dff288e9754b30ba49f1c88609f6f90099e96ffbc7e5f772b544b1c7fb246dd7f891632f02e1d605de75e9898a60a5346a3a82d935afdaf1a50fb4e6fae

  • SSDEEP

    1536:zoxBP0D61Oj3+5FdOa52C8pdo95j6hZ2MzNDCkrR:0PPUj3+5FMIn8To94wa7R

  Score

  10^/10

  sakuladiscoverypersistencerattrojanupx

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2