Extracted

• • Target

    JaffaCakes118_885e036d4343f7f58012addfafc5adaa

  • Size

    304KB

  • MD5

    885e036d4343f7f58012addfafc5adaa

  • SHA1

    075e528ae09391cae0f7e4a149ee75eb61d2a7aa

  • SHA256

    a53d94cc8e182c40fe89ce31190649765b823ecfd3e828bfe576697e06e371e3

  • SHA512

    7f55dfe98eb21992d38c6864e11851c2841b2c46d7f0fb6d224df13693d3600e4560108eb03ed88ee324c49fc5cf57f36148431770731bf0211a6df2bdd07b82

  • SSDEEP

    6144:M29qRfVSndj30B3wBxE1+ijiBKk3etdgI2MyzNORQtOfl1qNVo7R+S+N/n:0RfQn+w8EYiBlT

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2