Extracted

• • Target

    816e62bb61260ab92e84a5bd6318d20fc0b5d09f3556e0bf975dc7b9cefd5c43.exe

  • Size

    92KB

  • MD5

    c4501b63e275a2f3ae198ece60627458

  • SHA1

    e491c0189fc20109bd470afb90474c0ac3c50eef

  • SHA256

    816e62bb61260ab92e84a5bd6318d20fc0b5d09f3556e0bf975dc7b9cefd5c43

  • SHA512

    2b430b551684b532c653cd3d3358a5e1b2011f8cd7796f71da618daf5c0758c76dff86cbae53f28a62fc5620fb32b853e74b0c243e2ab7778b9316cc27efa9af

  • SSDEEP

    1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrE:9bfVk29te2jqxCEtg30Bg

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2