Extracted

• • Target

    JaffaCakes118_c68e35bcece63fae18058ca1ecd5bef9

  • Size

    3.6MB

  • MD5

    c68e35bcece63fae18058ca1ecd5bef9

  • SHA1

    de4c9450a689ba76442b2e8572670033b39bc713

  • SHA256

    629de23984c12b331c27e892dad33e4d693622b6e2f9d7c0cb9e66325f57e6c5

  • SHA512

    2e9539d4093955934c3a0ba10073ffd45a909bda29ab4685fe9bbf1e62791f1891333b12d1a9a8584268a09dde8dc519dd9a0c60a9b2205f88d5b2dbc6df329f

  • SSDEEP

    49152:o852ZjeUNZZH46HsnHVT5ZA+acdD6xXTI8:oU6eUNZZJHsHe

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2