Extracted

• • Target

    bb3ce31f9d2c3f499b91359bb5efc8ccfff814eab8fb65ab5c0ae6b161e908a4N.exe

  • Size

    912KB

  • MD5

    af5fc906cb4eb002b1a4b14a8bc45020

  • SHA1

    aee9ca177b7d8b33fd4462518b1fdde8ec475946

  • SHA256

    bb3ce31f9d2c3f499b91359bb5efc8ccfff814eab8fb65ab5c0ae6b161e908a4

  • SHA512

    ac3b2b5c4449c9bc3a3c344e3d72adeb82c71a0defa83f51e385e68551319791aebaef484177b8a688389adc72e4b99712339cd33029d220439e8b6e0af053ee

  • SSDEEP

    12288:0RfQn+w8EYiBlMkn5f9J105ko8T6csV5f1bYQog9hVn454E4Ciy:g4+wlYBsb3zNs5f1bYInVn454Egy

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2