Extracted

• • Target

    82940fa3ed8dc2741ae574a0c838e900daa74f8481d8be4a9ddab1ad06a8b7a3N.exe

  • Size

    63KB

  • MD5

    3fb6663de6801190409249b761189950

  • SHA1

    08f016d0c755bdf62447fff69e7e4dcd7cbc6d0d

  • SHA256

    82940fa3ed8dc2741ae574a0c838e900daa74f8481d8be4a9ddab1ad06a8b7a3

  • SHA512

    fb16401b14dd6733fa1e9e98f77b0de7595fe314961b240d40f4ce39d4106c6fc712733c53f55f30f85b2241a9f82d9636e26534c956d6389d0080db5eef765f

  • SSDEEP

    1536:zoxBP0D61Oj3+5FdOa52C8pdo95j6hZ2MzNDCkrU:0PPUj3+5FMIn8To94wa7U

  Score

  10^/10

  sakuladiscoverypersistencerattrojanupx

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2