Extracted

• • Target

    0f80d09a3cf0c5c3eda0d2d8caf5a39840e9fa77fd5680f0e1c2e75f6648080aN.exe

  • Size

    42KB

  • MD5

    9e4c94db30424788e7fc25b12b11d340

  • SHA1

    1a4f86c4fd05a35925e3fd2a89ec7004d062abb9

  • SHA256

    0f80d09a3cf0c5c3eda0d2d8caf5a39840e9fa77fd5680f0e1c2e75f6648080a

  • SHA512

    ffc0df205ab1ad9d63bf58ba110a0bebb887952c3979cadd2bfb481e0e9219669b6819acbd2a2deedba932228bbe3c1638bda9ef1776a5270452b951a032cf20

  • SSDEEP

    768:OxHCfu/Qejf1u3K01c63gxCEk5mVB9CwxbAjrqge49sgf/mEAgG/MB3GJoA66:O59/D1X6UCBoVbJ8reTS/wMlAF

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2