Extracted

• • Target

    2025-04-01_c2ba8a89f39f40ddffcb97dab4fcd443_amadey_rhadamanthys_sakula_smoke-loader.exe

  • Size

    89KB

  • MD5

    c2ba8a89f39f40ddffcb97dab4fcd443

  • SHA1

    506cda450ca18935ee14f453f2b33c4a43f99963

  • SHA256

    e239a0b9b21b1a8bd6030651664a305da5eb16918cd149e7bf4c0d1d1ad4aed7

  • SHA512

    7709b6ab86ff4ec72af5f2de596881819b64743c788807e09196d2e9f33c33d27cf767578f1b557edb4154669f91d9620b864d4446135987531b40ecd98cb82d

  • SSDEEP

    1536:PQFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX+ees52z30rtra:w29DkEGRQixVSjLaes5G30B+

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1