Extracted

• • Target

    34740d187213ea7125ff671c523d615fede95ad995da848f88efe832eb768120N.exe

  • Size

    92KB

  • MD5

    c476a5590760e8d9705ef8c743140d30

  • SHA1

    12042365157c609da58e6d437bea556adc905d65

  • SHA256

    34740d187213ea7125ff671c523d615fede95ad995da848f88efe832eb768120

  • SHA512

    2b75ee388567268fa9caeb582aee376b04b4dd6367f79354fe81b405470ed865caae787828300a9efea5902b3f1bff0358b7af42bff73fbb2a9b88d3487d868d

  • SSDEEP

    1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrn:9bfVk29te2jqxCEtg30BL

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2