Extracted

• • Target

    74bed029622dc20a3e02eee9a31016d4ad08dfb630423c0ef56a3f17057b757dN.exe

  • Size

    92KB

  • MD5

    92bd3a35816994d58b31b8d6158314d0

  • SHA1

    15e9432e74c03b50436197c096787def64228ed1

  • SHA256

    74bed029622dc20a3e02eee9a31016d4ad08dfb630423c0ef56a3f17057b757d

  • SHA512

    9164a4f600886957efd8e88b00d882e04da3945704632b73b179948636fec8774da5d4ae2555833fa593937fe7adddc391797849a1041a5d4e6b00fa49a464c8

  • SSDEEP

    1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrP:9bfVk29te2jqxCEtg30BT

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2