General

  • Target

    2025-04-21_3c2929ca681537924b1dda61f3d7e1ce_amadey_elex_rhadamanthys_sakula_smoke-loader

  • Size

    92KB

  • Sample

    250421-e9m3msssfx

  • MD5

    3c2929ca681537924b1dda61f3d7e1ce

  • SHA1

    678862aaefc3889124b83f086fbe37576f2c0a57

  • SHA256

    14241c2e57a21e18170d9893c4b34aca7322e15f9a10a45a7c5d2d8ab85cd1f3

  • SHA512

    fc0631eae900b13dc4d042db59e10fedf3576f4d644cc447ec29b14aa4d3a29727e77b5ab9d8e501755461d51a881f65768e419929ac63cc02b24726e9e6bfb7

  • SSDEEP

    1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrK:9bfVk29te2jqxCEtg30BO

Malware Config

Extracted

Family

sakula

C2

www.savmpet.com

Targets

    • Target

      2025-04-21_3c2929ca681537924b1dda61f3d7e1ce_amadey_elex_rhadamanthys_sakula_smoke-loader

    • Size

      92KB

    • MD5

      3c2929ca681537924b1dda61f3d7e1ce

    • SHA1

      678862aaefc3889124b83f086fbe37576f2c0a57

    • SHA256

      14241c2e57a21e18170d9893c4b34aca7322e15f9a10a45a7c5d2d8ab85cd1f3

    • SHA512

      fc0631eae900b13dc4d042db59e10fedf3576f4d644cc447ec29b14aa4d3a29727e77b5ab9d8e501755461d51a881f65768e419929ac63cc02b24726e9e6bfb7

    • SSDEEP

      1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrK:9bfVk29te2jqxCEtg30BO

    • Sakula

      Sakula is a remote access trojan with various capabilities.

    • Sakula family

    • Sakula payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v16

Tasks