Extracted

• • Target

    2025-04-15_d924929f9198e9720b51696d9b55c63f_amadey_elex_rhadamanthys_sakula_smoke-loader

  • Size

    92KB

  • MD5

    d924929f9198e9720b51696d9b55c63f

  • SHA1

    63eead05a29d59badcd59398700d9017128f09a6

  • SHA256

    6bdf249983555f4f04adfa03e560ed4b3e80354cd298a427d37a3b350a5780b3

  • SHA512

    77d7deec4458696d9cb3f1c5b3148bda78c89bba23f9a657047eb265a6e9477606091b25368c644d7ab9ce86f3d36d375d674d18c81f19035355671e9226c60d

  • SSDEEP

    1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrn:9bfVk29te2jqxCEtg30Bb

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1