Extracted

• • Target

    01b9a00ac9e24d13ff12e364979530528c62cc7b3964ef83990520d5f537228fN.exe

  • Size

    63KB

  • MD5

    8e32120cae8e893761e70d94d98e93e0

  • SHA1

    64612406b390a9233442181c07543b25047c315d

  • SHA256

    01b9a00ac9e24d13ff12e364979530528c62cc7b3964ef83990520d5f537228f

  • SHA512

    cc7348e71ccbda53100bb8e0a9fb6be7b00b3b1793f020e2367503ee6bfe7539f3648968988c5ccc3d39fa078df430829c69eb3f836e1e540973c3619e2881fe

  • SSDEEP

    1536:zoxBP0D61Oj3+5FdOa52C8pdo95j6hZ2MzNDCkr0:0PPUj3+5FMIn8To94wa70

  Score

  10^/10

  sakuladiscoverypersistencerattrojanupx

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2