Overview

overview

10

Static

static

10

2025-04-11...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-04-11_d2359bfbc16a7bd3c3ff9a7cadaaa68f_amadey_elex_rhadamanthys_sakula_smoke-loader

  • Size

    114KB

  • Sample

    250411-vgkd2svwh1

  • MD5

    d2359bfbc16a7bd3c3ff9a7cadaaa68f

  • SHA1

    fef584617a4e7bd4aa270e56d6dd3a6d0d995727

  • SHA256

    1ee11112519a9a6f02b6eb15b58239b38be78ba277fb79e3212b7f07994d033e

  • SHA512

    5c3b15933a54bddda22668d461d366ae481b1093e4976cc0d22dd1ae9fdc68b9ec6ec97e0143fcfdad74fb0978d92d8a3243f587fe0fa49bde3f8b6e339fd8c6

  • SSDEEP

    1536:Loaj1hJL1S9t0MIeboal8bCKxo7h0RPLJNz30rtriCr0nJnHPoq1nouy8TRgY:c0hpgz6xGhYJF30Blr0nhoutTRgY

Score
10/10
sakuladiscoverypersistencerattrojanupx

Malware Config

Targets

    • Target

      2025-04-11_d2359bfbc16a7bd3c3ff9a7cadaaa68f_amadey_elex_rhadamanthys_sakula_smoke-loader

    • Size

      114KB

    • MD5

      d2359bfbc16a7bd3c3ff9a7cadaaa68f

    • SHA1

      fef584617a4e7bd4aa270e56d6dd3a6d0d995727

    • SHA256

      1ee11112519a9a6f02b6eb15b58239b38be78ba277fb79e3212b7f07994d033e

    • SHA512

      5c3b15933a54bddda22668d461d366ae481b1093e4976cc0d22dd1ae9fdc68b9ec6ec97e0143fcfdad74fb0978d92d8a3243f587fe0fa49bde3f8b6e339fd8c6

    • SSDEEP

      1536:Loaj1hJL1S9t0MIeboal8bCKxo7h0RPLJNz30rtriCr0nJnHPoq1nouy8TRgY:c0hpgz6xGhYJF30Blr0nhoutTRgY

    Score
    10/10
    sakuladiscoverypersistencerattrojanupx

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula family

      sakula

    • Sakula payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks