Extracted

• • Target

    aedcee7cec12ab616d26f310626fadfa811079c64c89dafe459ba8ac84eca5af

  • Size

    41KB

  • MD5

    82e074bf86f869c71af4e49626141473

  • SHA1

    9108f470cde0faba40185417da7393d7da107d11

  • SHA256

    aedcee7cec12ab616d26f310626fadfa811079c64c89dafe459ba8ac84eca5af

  • SHA512

    a1218c87d764c28d62f3f1c9806610b79d31c84ea93eaf9f308612a05a44b9ec62f7c88b4ad8d5b068eeae5e785313d37c0bbc44d7d9c122abffaf3decc4b01b

  • SSDEEP

    768:9zpVJi5kPTIukEYpcHOZ6rFSBZxkXNVkSXtfgn3JkcBwQoabJF7nbcuyD7UX:N/JKiMLE9bOq5fgn6Ozoaz7nouy8X

  Score

  10^/10

  sakuladiscoverypersistencerattrojanupx

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2