General

  • Target

    2025-04-22_5263d56c5d2a564645bb7177ee65830d_amadey_elex_rhadamanthys_sakula_smoke-loader

  • Size

    103KB

  • Sample

    250422-wjm4dsxjy9

  • MD5

    5263d56c5d2a564645bb7177ee65830d

  • SHA1

    ec75e3414eed1e8cbaa1db80986ad9c2770194e7

  • SHA256

    f31ebbfc030e20df3dfce7f411087156b70468fa65d6702dd9f51a87ca8e71e0

  • SHA512

    eb8f903bf5224930dbe9bf00bbcdbd1a894a5b8b75c36d9ce518bd988254770f9764b4b46e9b2c5ad8cc1d8398cd5e26d740a8a6702a25d6e72de6412d827bf9

  • SSDEEP

    1536:coaj1hJL1S9t0MIeboal8bCKxo7h0RPqaml0Nz30rtrRx:X0hpgz6xGhJamyF30Bdx

Malware Config

Targets

    • Target

      2025-04-22_5263d56c5d2a564645bb7177ee65830d_amadey_elex_rhadamanthys_sakula_smoke-loader

    • Size

      103KB

    • MD5

      5263d56c5d2a564645bb7177ee65830d

    • SHA1

      ec75e3414eed1e8cbaa1db80986ad9c2770194e7

    • SHA256

      f31ebbfc030e20df3dfce7f411087156b70468fa65d6702dd9f51a87ca8e71e0

    • SHA512

      eb8f903bf5224930dbe9bf00bbcdbd1a894a5b8b75c36d9ce518bd988254770f9764b4b46e9b2c5ad8cc1d8398cd5e26d740a8a6702a25d6e72de6412d827bf9

    • SSDEEP

      1536:coaj1hJL1S9t0MIeboal8bCKxo7h0RPqaml0Nz30rtrRx:X0hpgz6xGhJamyF30Bdx

    • Sakula

      Sakula is a remote access trojan with various capabilities.

    • Sakula family

    • Sakula payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v16

Tasks