Extracted

• • Target

    JaffaCakes118_c2793dfee2db3b39b0a6749a88d86f25

  • Size

    520KB

  • MD5

    c2793dfee2db3b39b0a6749a88d86f25

  • SHA1

    498833271d0b9f7eb0c002f83aa2cae3ca980de3

  • SHA256

    80651c8632921138735275775282f5e9f1e9989c6bc08f3e476017a54499a650

  • SHA512

    99a583c1c0d27255ae8a95ccacf76524cbd86be0d10d5be0d742a131dc6563e8c64f4df8c2b34588175364da069d8a2e7145236c7ef8cf3d6318096415c1a890

  • SSDEEP

    12288:0RfQn+w8EYiBlMkn5f9J105ko8T6csVeC:g4+wlYBsb3zNsL

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2