Extracted

• • Target
    2026-07-05_433808630b31ae3aa0fffeeb05bca8ad_amadey_elex_rhadamanthys_sakula_smoke-loader_stop
  • Size 92KB
  • SHA256 42bdd883113a76041f61983012a27d7edfc82045a7d46d4374afd94134833663
  • MD5 433808630b31ae3aa0fffeeb05bca8ad
  • SHA1 484744e417a0af7351dea9ff4e493d95dab2f608
  • SHA512 666bacb0dee8ce81d5627de209d7a1d620ec63dd85e7a2a59dc8bb9be7e229c3bb4206b5a0d72fe2e2a06c1df6e749ea8bd8069a879cb40d35f8b5952a53f6fa
  • SSDEEP 1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtr8:9bfVk29te2jqxCEtg30BY
  • TLSH
    T142938D13B8D2C073F40601755159CB935B7BBA032FBDD9D7BB940A8EBA622D0463BAC4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverysakulapersistencerattrojanadwareransomwarespyware

  • Family: Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula payload

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2