Extracted

• • Target

    319a2b33c352fe6f91b6ab0feaac1c0b765dfce5b5c0dbc845f64c0c0e6cc0c0

  • Size

    41KB

  • MD5

    50de155ac587f1c288849ceb0e3e6b66

  • SHA1

    d2162b11bda6e812410309592148d500eba15ecf

  • SHA256

    319a2b33c352fe6f91b6ab0feaac1c0b765dfce5b5c0dbc845f64c0c0e6cc0c0

  • SHA512

    f844a548e584ca4e24b510ee811900353d9cdc03f1d20d0b8ec917c854974d25b845bf2b0945b8ec56e3dbbdf82cd1f3f26f416112d2dffadb5c31574d5b3e07

  • SSDEEP

    768:9zpVJi5kPTIukEYpcHOZ6rFSBZxkXNVkSXtfgn3JkcBwQoabJF7nbcuyD7UQ:N/JKiMLE9bOq5fgn6Ozoaz7nouy8Q

  Score

  10^/10

  sakuladiscoverypersistencerattrojanupx

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2