Extracted

• • Target

    2025-05-20_5eed46ae0e862f6580ee543600e15e3a_amadey_elex_gcleaner_rhadamanthys_sakula_smoke-loader

  • Size

    92KB

  • MD5

    5eed46ae0e862f6580ee543600e15e3a

  • SHA1

    e8dd729da08548b0be804ff9b213ec0ab31aa2f4

  • SHA256

    0468d83546aa25ba004991170891d830c2007d481e1af927546e6e06f4af7956

  • SHA512

    24158172c4ba5f150ee36d1f81df10528e5c99b868a284e5d6a5b8bdd3d3afb333c5bad385077dfefd1d20c99596dd2afdf841f76f0c243bff804b15088db6be

  • SSDEEP

    1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrv:9bfVk29te2jqxCEtg30BT

  Score

  10^/10

  sakuladiscoverypersistencerattrojan

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula family

    sakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2