Overview

overview

10

Static

static

10

2025-04-11...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-04-11_133e221864299ee38c17d8401414a21f_amadey_elex_rhadamanthys_sakula_smoke-loader

  • Size

    114KB

  • Sample

    250411-t18qbavmy2

  • MD5

    133e221864299ee38c17d8401414a21f

  • SHA1

    c4038037a94a16e993e3bbfadb9f903dee479d27

  • SHA256

    eecedf9ccc5cc2b5ca414475bddd2ae6c7db3af60d2f6e0b117b5d76930f6775

  • SHA512

    c4c47c9f4d36033b4774eecd1f5d9c36b765f136c796591205608a6563a9f51a95154c8757c2eba7446822f4a8333b5fd9286f39695c1d51eafb795d35efb7c5

  • SSDEEP

    1536:Loaj1hJL1S9t0MIeboal8bCKxo7h0RPLJNz30rtriCr0nJnHPoq1nouy8TRgi:c0hpgz6xGhYJF30Blr0nhoutTRgi

Score
10/10
sakuladiscoverypersistencerattrojanupx

Malware Config

Targets

    • Target

      2025-04-11_133e221864299ee38c17d8401414a21f_amadey_elex_rhadamanthys_sakula_smoke-loader

    • Size

      114KB

    • MD5

      133e221864299ee38c17d8401414a21f

    • SHA1

      c4038037a94a16e993e3bbfadb9f903dee479d27

    • SHA256

      eecedf9ccc5cc2b5ca414475bddd2ae6c7db3af60d2f6e0b117b5d76930f6775

    • SHA512

      c4c47c9f4d36033b4774eecd1f5d9c36b765f136c796591205608a6563a9f51a95154c8757c2eba7446822f4a8333b5fd9286f39695c1d51eafb795d35efb7c5

    • SSDEEP

      1536:Loaj1hJL1S9t0MIeboal8bCKxo7h0RPLJNz30rtriCr0nJnHPoq1nouy8TRgi:c0hpgz6xGhYJF30Blr0nhoutTRgi

    Score
    10/10
    sakuladiscoverypersistencerattrojanupx

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula family

      sakula

    • Sakula payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks