Extracted

• • Target

    dcba6cea57530efa63804d598920c9061dff97e742a894bcdee34a78229f95df

  • Size

    92KB

  • MD5

    8f23b418e951130c747f1330ff0768ce

  • SHA1

    44b5fdecef41a603b73628c6d4da731ef6b8371f

  • SHA256

    dcba6cea57530efa63804d598920c9061dff97e742a894bcdee34a78229f95df

  • SHA512

    8a6b0e40e027a5120cb256bc18e8c9a2edc76ffee5f58955e4f1bf63455850e905e337d2bf9d1f120689d50225f9f8dfc78fba426938e840d1139db4e9fb9b60

  • SSDEEP

    1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtr6:9bfVk29te2jqxCEtg30Bu

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2