Extracted

• • Target

    c47cfc59b26799b18a4e3b330a3051a086d7803fca8b23ae41fcf0d80bdc242d

  • Size

    63KB

  • MD5

    21fb6978bca986e64cf6bd382e8c6b77

  • SHA1

    bfd4eeada02a08e6550f695f67f6cacd6114a747

  • SHA256

    c47cfc59b26799b18a4e3b330a3051a086d7803fca8b23ae41fcf0d80bdc242d

  • SHA512

    2e474fbbda6ef604d4e5f5fac98d3502e3c8ff8c5e0dd9d37e6e51e5549f92f15376e05e79c31526e9a75813fd5c1119583588f9aa2caac9af1abb4eadb4303d

  • SSDEEP

    1536:zoxBP0D61Oj3+5FdOa52C8pdo95j6hZ2MzNDCkrs:0PPUj3+5FMIn8To94wa7s

  Score

  10^/10

  sakuladiscoverypersistencerattrojanupx

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2