Extracted

• • Target

    c28cdacbe5077074a2a02f0dcdda32bdd515d3192b54a010d0d8c80a622bef01

  • Size

    632KB

  • MD5

    004f30f6d5158090d621cf2b15cf1cfb

  • SHA1

    c449494b45f7546e1cced529e29a9b8b914d3889

  • SHA256

    c28cdacbe5077074a2a02f0dcdda32bdd515d3192b54a010d0d8c80a622bef01

  • SHA512

    d24f72824e08ea350caff020dea70309663a811fbfe285e502ea06a59c0df7b60c7faa88f3daa0e752e920fcedbc0ffb7231f2120e6aabfe1536893a2d2068b2

  • SSDEEP

    12288:0RfQn+w8EYiBlMkn5f9J105ko8T6csV5R:g4+wlYBsb3zNs5R

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2