Extracted

• • Target

    2025-03-31_fdac1e896bf8af45c92d9ad4172036e2_amadey_rhadamanthys_sakula_smoke-loader

  • Size

    92KB

  • MD5

    fdac1e896bf8af45c92d9ad4172036e2

  • SHA1

    21aa338ac42ca3f7aa0ecff777fdb1c251b4928f

  • SHA256

    8763e4511886f1b652ff967880bbcce1217490850d0cc0bfae388a11998a7a82

  • SHA512

    9a34816c9530e2601bd48b7dd040952a737b05db517a5c48058292bada9a177bc7574be218b03a5dab43f7d22d9f157d43dd44401a17a65e731466c6f095db06

  • SSDEEP

    1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrJ:9bfVk29te2jqxCEtg30Bl

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1