Extracted

• • Target

    8043bf9fe3d8a895be40724055b8747f289a59422feabaad073d9e25ddee306bN.exe

  • Size

    92KB

  • MD5

    2ceecd1d7a7f49ccc44aaeca1aaddc90

  • SHA1

    a86faa77b7a4abafa84a47aab6c77558ddf08adf

  • SHA256

    8043bf9fe3d8a895be40724055b8747f289a59422feabaad073d9e25ddee306b

  • SHA512

    2a36fd037d825c0f1f96da88a46b046f705e333567efab6706667a9c71b6a48b0a97429001a195eb2d75353cca1c79ba2eaba2d426d55ff52287b3346ac008d5

  • SSDEEP

    1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrZ:9bfVk29te2jqxCEtg30B9

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2