Overview

overview

10

Static

static

10

2025-04-14...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-04-14_4122447ee8c9e7dd067aeee40ab3a1c3_amadey_elex_rhadamanthys_sakula_smoke-loader

  • Size

    99KB

  • Sample

    250414-h4rqess1aw

  • MD5

    4122447ee8c9e7dd067aeee40ab3a1c3

  • SHA1

    91507f9ea43b0ac21e56f9cc6b5dd17c84da0573

  • SHA256

    f4d5f3c22ca2dbe666ee29e81ec2bd31ec82401e9abf6259ec106d474544f9c1

  • SHA512

    9d283cb34d99322a2f1d0862c9a3fb3644f862429c2ada6f6969c7b77e82e50d65fe0c55ff2521b532938b44f5edb5bafa0666125b1d2b5b5c236c5d62890429

  • SSDEEP

    1536:soaj1hJL1S9t0MIeboal8bCKxo7h0RPSaml0Nz30rtrz80:H0hpgz6xGhpamyF30Bv80

Score
10/10
sakuladiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      2025-04-14_4122447ee8c9e7dd067aeee40ab3a1c3_amadey_elex_rhadamanthys_sakula_smoke-loader

    • Size

      99KB

    • MD5

      4122447ee8c9e7dd067aeee40ab3a1c3

    • SHA1

      91507f9ea43b0ac21e56f9cc6b5dd17c84da0573

    • SHA256

      f4d5f3c22ca2dbe666ee29e81ec2bd31ec82401e9abf6259ec106d474544f9c1

    • SHA512

      9d283cb34d99322a2f1d0862c9a3fb3644f862429c2ada6f6969c7b77e82e50d65fe0c55ff2521b532938b44f5edb5bafa0666125b1d2b5b5c236c5d62890429

    • SSDEEP

      1536:soaj1hJL1S9t0MIeboal8bCKxo7h0RPSaml0Nz30rtrz80:H0hpgz6xGhpamyF30Bv80

    Score
    10/10
    sakuladiscoverypersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula family

      sakula

    • Sakula payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks