Extracted

• • Target

    b6b72cd7d9143f8ec845893ccf3dc74e850c0bb0e308f0ecb4c54aeb5ff86f98

  • Size

    92KB

  • MD5

    9539c01fdb566eba7251c27b06225f08

  • SHA1

    b7567b406d97690cacf55ea020a214cd125d1661

  • SHA256

    b6b72cd7d9143f8ec845893ccf3dc74e850c0bb0e308f0ecb4c54aeb5ff86f98

  • SHA512

    2782ea2b51b937e40a342dd769a183f2997903d8508a9be3b1e2b209fc8e1b00da72a575f3694429281677307d1a5e757250ad0b1a5c0ae909250fec6854b747

  • SSDEEP

    1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtru:9bfVk29te2jqxCEtg30Ba

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2