Extracted

• • Target

    568c6f6d618888fc5e45fdf92efc1f1b305ea0fe44a381e658c742606a49642bN.exe

  • Size

    41KB

  • MD5

    90e2860356fe3144cd81609f566a5d50

  • SHA1

    a101eecbcdcac2439bcc1ff8dfe8ace7aac734e6

  • SHA256

    568c6f6d618888fc5e45fdf92efc1f1b305ea0fe44a381e658c742606a49642b

  • SHA512

    09ad6fd2846d67e2519d292a39b4e39320d8ca6b0a80a6000c89ebef4f034d5cdd5a9acc753cf43eba73d6745fc57d46bed69975cdb79d0d7d15b75fb6f8d833

  • SSDEEP

    768:9zpVJi5kPTIukEYpcHOZ6rFSBZxkXNVkSXtfgn3JkcBwQoabJF7nbcuyD7UT:N/JKiMLE9bOq5fgn6Ozoaz7nouy8T

  Score

  10^/10

  sakuladiscoverypersistencerattrojanupx

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2