Extracted

• • Target
    2026-11-02_d6e302d6dbf1b0e95addb9fbb7ef742d_amadey_elex_redline-stealer_rhadamanthys_sakula_smoke-loader_stop_wannacry
  • Size 304KB
  • SHA256 805189971ca48e58ca5a305c6a363fd02cb538692e343c316bb9b8fa896fe73d
  • MD5 d6e302d6dbf1b0e95addb9fbb7ef742d
  • SHA1 502bb7e28e3fae468a558c059eedf5b1d8f3cd7e
  • SHA512 6d2137b5dcbadd9e8495bbe861562ad99f131af29efca3ce840d695cb6a9cca1addee5e805713211ae67a8deec0ad795e959e81f838afc60fb757791e54945ec
  • SSDEEP 6144:M29qRfVSndj30B3wBxE1+ijiBKk3etdgI2MyzNORQtOfl1qNVo7R+S+N/9:0RfQn+w8EYiBlJ
  • TLSH
    T149646C346ACE84B1E34644B2A8B397E64676BC3C5F1ACA1FE7887F1D19732C06591D0B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionsakulapersistencerattrojan

  • Family: Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula

  • Sakula payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2