Extracted

• • Target

    2025-04-13_5373cec20ada5702dd2a076bbdcbee76_amadey_elex_rhadamanthys_sakula_smoke-loader

  • Size

    92KB

  • MD5

    5373cec20ada5702dd2a076bbdcbee76

  • SHA1

    6c654bd9c50192f530686019f12536510ffe5816

  • SHA256

    8c8754f2baa35506e7e4d17682e2defcf422eb7422ee0dc250a374de190079fb

  • SHA512

    222313ce47c10c81f0fb3651d31688cc9d4212c2239dd664b395efe1aa8964ecd64fa6164fd64e94f6bb07ce8143c3deb61dfd755c5b4e0954a8c19277d8cd29

  • SSDEEP

    1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtr8:9bfVk29te2jqxCEtg30BI

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1