Extracted

• • Target

    7cdb15b4ed3ac8a3c20a67a12b320e7551a101b7c42054fe77b5521238681d3e.exe

  • Size

    92KB

  • MD5

    af9c2ef84126a4db946fab35fc7d38b1

  • SHA1

    30e07ab93c52099ed5273f45c7ecf26c3d51ed5e

  • SHA256

    7cdb15b4ed3ac8a3c20a67a12b320e7551a101b7c42054fe77b5521238681d3e

  • SHA512

    4988952148675816663191fe9fc9cefbb6539a214bdcafcb865464cfcce80820c5db34a3e4a83ce792d43040913ad6d626c7b90f8c1b6a54a27feede2d82aa2d

  • SSDEEP

    1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrC:9bfVk29te2jqxCEtg30BO

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2