Extracted

• • Target
    2026-10-24_ca58a4be75d1a2f036f7c86ee968f893_amadey_elex_redline-stealer_rhadamanthys_sakula_smoke-loader_stop_wannacry
  • Size 259KB
  • SHA256 53d107f27bb99c859575f9cf2f3abedcc98b048e4f03338f04a763d925a4bf2e
  • MD5 ca58a4be75d1a2f036f7c86ee968f893
  • SHA1 9f0dfc452d819a92fe7850fc0feed42f5bb6b8b3
  • SHA512 8c2c363e96db6236b42bc6b861b7d4eb0293d6e5fb4d898b9bccd67d9be4d819c34ceb7a03fa780582a6784ff717438ca2cf110f6934e322f2d0fa3320082b02
  • SSDEEP 3072:M29DkEGRQixVSxLwes5G30Bg7uZwOuz8xS3iGpZMhDEXzkOSUUKeF8a7bXxBgW4z:M29qRfVSZdj30B3wSxE1+ijiBKz
  • TLSH
    T1BC448D18B54DC036E48C05746C1287A64AB77C3D1F2DC92BEB40BF2D2D373D4AA9A64B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionsakulapersistencerattrojan

  • Family: Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2