Overview

overview

10

Static

static

10

2025-04-11...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-04-11_590b9fd5634731846fcdbe437edccbd6_amadey_elex_rhadamanthys_sakula_smoke-loader

  • Size

    114KB

  • Sample

    250411-sflvdasxcx

  • MD5

    590b9fd5634731846fcdbe437edccbd6

  • SHA1

    5098b4cc4ef87fa604de7212fa7ac686d72833cb

  • SHA256

    5b21af697b57c8c61bbc6f88a331fc28e603491f72975ad672132b5b5d9644b6

  • SHA512

    303422c7dbe02019e77d0e3e650ff5ffc151059ffeb27338cc1f6575274f34d719638171c321bcc6287206e3bbb8515be85315f0395f956f77b79af37ce10e0a

  • SSDEEP

    1536:Loaj1hJL1S9t0MIeboal8bCKxo7h0RPLJNz30rtriCr0nJnHPoq1nouy8TRgk:c0hpgz6xGhYJF30Blr0nhoutTRgk

Score
10/10
sakuladiscoverypersistencerattrojanupx

Malware Config

Targets

    • Target

      2025-04-11_590b9fd5634731846fcdbe437edccbd6_amadey_elex_rhadamanthys_sakula_smoke-loader

    • Size

      114KB

    • MD5

      590b9fd5634731846fcdbe437edccbd6

    • SHA1

      5098b4cc4ef87fa604de7212fa7ac686d72833cb

    • SHA256

      5b21af697b57c8c61bbc6f88a331fc28e603491f72975ad672132b5b5d9644b6

    • SHA512

      303422c7dbe02019e77d0e3e650ff5ffc151059ffeb27338cc1f6575274f34d719638171c321bcc6287206e3bbb8515be85315f0395f956f77b79af37ce10e0a

    • SSDEEP

      1536:Loaj1hJL1S9t0MIeboal8bCKxo7h0RPLJNz30rtriCr0nJnHPoq1nouy8TRgk:c0hpgz6xGhYJF30Blr0nhoutTRgk

    Score
    10/10
    sakuladiscoverypersistencerattrojanupx

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula family

      sakula

    • Sakula payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks