Extracted

• • Target
    2026-08-13_9f53dc5a0e470cfdfb36d894faf183b7_amadey_coinminer_elex_redline-stealer_rhadamanthys_sakula_smoke-loader_stop
  • Size 212KB
  • SHA256 4a2b0ef0eb86a93cd8d25894fb19b190ae4f52188ebd771e4749cb60b067d73a
  • MD5 9f53dc5a0e470cfdfb36d894faf183b7
  • SHA1 faa4ae407b8ad1049e2f8c66a4b82579c919d7df
  • SHA512 69a432b9dafb6b17a30319761c4e19c17e7000f1fcfc2c62443de59a7d25cf3e7a419fb6bfced9877e891232c5945bd801fbace7691594ee703550a6b10df776
  • SSDEEP 1536:XcQFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX++pdz30rtr8gjXjp0danBV:r29DkEGRQixVSjLc130BYgjXjpDnBV
  • TLSH
    T146248E11B9C1C072D04751386569EB734A7F752107B8C993BB841BBEBE613D09A3FACA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionsakulapersistencerattrojanupx

  • Family: Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula payload

  • UPX dump on OEP (original entry point)

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2