Extracted

• • Target

    57e9c9c159639ce8b0c77267819bf7be679b11cd75028563d269812af8da9b38.exe

  • Size

    43KB

  • MD5

    70a46805907fdfc1533e32145514ce67

  • SHA1

    dcd7e4e5ad6a55b6a7f4e9805d2bc93f57fe01d0

  • SHA256

    57e9c9c159639ce8b0c77267819bf7be679b11cd75028563d269812af8da9b38

  • SHA512

    e7facdc21419a47166d572ee6068fde84bfc9dc188f6580725fe930ed7a033aeca118e440098629c11ef622dad33e5d11c41a617037b14a9392f199793b030e3

  • SSDEEP

    768:OxHCfu/Qejf1u3K01c63gxCEk5mVB9CwxbAjrqge49sgf/mEAgG/MB3GJoA6u:O59/D1X6UCBoVbJ8reTS/wMlA3

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2