Extracted

• • Target

    d1198ada6be2c00175d0be08ceadec1167500f25f1b518cda430b4898e9f9fdb.exe

  • Size

    92KB

  • MD5

    ce9e497fe47ad84b396822a52e9b15af

  • SHA1

    c2aaf94ca100c28c0e3e64258ffa7500c1c19825

  • SHA256

    d1198ada6be2c00175d0be08ceadec1167500f25f1b518cda430b4898e9f9fdb

  • SHA512

    d50582a1689a84a8aff2f154cbdbe33063f6c9de0a4337b91aed4050f3b8514f1b85887742b4b82a81273807277f0a5470d944a545276ef140b3e0050820f66d

  • SSDEEP

    1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrH:9bfVk29te2jqxCEtg30BD

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2