Extracted

• • Target

    38121d9807f873d6721e99d31c03d78795745d82eb7198b1914bb8ad14cde7b2N.exe

  • Size

    488KB

  • MD5

    c7eb9cb21122507077ab4a5ab2679840

  • SHA1

    7540f3ccdb65a56e20bf4558d5b67cfb17655780

  • SHA256

    38121d9807f873d6721e99d31c03d78795745d82eb7198b1914bb8ad14cde7b2

  • SHA512

    fe4e7b64579e7de2879c90b7133300f31cad0fbbe208262d55f73792614f905886adbfa631a203f4e98041620c4f887d8c8e315532b88077154dce73faa66801

  • SSDEEP

    6144:M29qRfVSndj30B3wBxE1+ijiBKk3etdgI2MyzNORQtOfl1qNVo7R+S+N/TU7kn56:0RfQn+w8EYiBlMkn5f9J105ko8T6csVN

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2