sakula | 2026-11-09_2a6760ccab7714530a222494247289ed_amadey_elex_karagany_redline-stealer_rhadamanthys_sakula_smoke-loader_stealc

General

Target
2026-11-09_2a6760ccab7714530a222494247289ed_amadey_elex_karagany_redline-stealer_rhadamanthys_sakula_smoke-loader_stealc
Size 191KB
Sample261111-aes8yssw2q
SHA256 5fc8d408452fb1a7f0db213399f2befb7ec1c4bddf994aab3afb1acb8545a1cc
MD5 2a6760ccab7714530a222494247289ed
SHA1 a758651a4c3e6624460707515377686a9a93cb2e
SHA512 40b67bdddb9727913b6f7ea1f006a59a20cd330bf22a3bffd60fb49ded6a1c037ef536ef1cc8e2f9d7e376416fe014c7c877d8d8299132498a64af768fce58bc
SSDEEP 1536:2oaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtroZeBsCXKTn3:h0hpgz6xGhTjwHN30BE8BsZ3
TLSH
T12C145B12B680C032D066057494F6E7B30A3AFD228A79C5877B89776F6FB02D19D36F16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan rat sakula

Malware Config

Signatures

Family: Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 1 IoCs

resource	yara_rule
sample	family_sakula

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-09_2a6760ccab7714530a222494247289ed_amadey_elex_karagany_redline-stealer_rhadamanthys_sakula_smoke-loader_stealc

File Explorer

2026-11-09_2a6760ccab7714530a222494247289ed_amadey_elex_karagany_redline-stealer_rhadamanthys_sakula_smoke-loader_stealc

.exe 191KB

2026-11-09_2a6760ccab7714530a222494247289ed_amadey_elex_karagany_redline-stealer_rhadamanthys_sakula_smoke-loader_stealc

IMPHASH 539502771da573641ecc7f6497e39f8f
SHA256 5fc8d408452fb1a7f0db213399f2befb7ec1c4bddf994aab3afb1acb8545a1cc
MD5 2a6760ccab7714530a222494247289ed
SHA1 a758651a4c3e6624460707515377686a9a93cb2e
SHA512 40b67bdddb9727913b6f7ea1f006a59a20cd330bf22a3bffd60fb49ded6a1c037ef536ef1cc8e2f9d7e376416fe014c7c877d8d8299132498a64af768fce58bc
SSDEEP 1536:2oaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtroZeBsCXKTn3:h0hpgz6xGhTjwHN30BE8BsZ3
TLSH
T12C145B12B680C032D066057494F6E7B30A3AFD228A79C5877B89776F6FB02D19D36F16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Sakula payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

17029

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentThread VirtualFree ExpandEnvironmentStringsA WriteFile OpenProcess WideCharToMultiByte GetVolumeInformationA Sleep SizeofResource CreateProcessA ReadFile GetSystemDirectoryA MultiByteToWideChar SetThreadPriority GetTickCount GetStartupInfoA FindFirstFileA GetLastError VirtualAlloc FindClose LockResource CreatePipe GetModuleFileNameA GetVersionExA WinExec CloseHandle GetCurrentProcessId GetTempPathA GetCurrentProcess LoadResource PeekNamedPipe SetFilePointer SetPriorityClass FindResourceA GetFileSize CreateFileA GetComputerNameA CreateDirectoryA ExitProcess CreateFileW GetProcessHeap SetEndOfFile HeapReAlloc GetStringTypeW LCMapStringW FlushFileBuffers WriteConsoleW SetStdHandle GetProcAddress GetModuleHandleW DecodePointer HeapFree HeapAlloc GetSystemTimeAsFileTime GetCommandLineA HeapSetInformation GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetStdHandle GetModuleFileNameW HeapCreate RtlUnwind GetConsoleCP GetConsoleMode SetHandleCount GetFileType FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize IsProcessorFeaturePresent

advapi32

RegOpenKeyA GetUserNameA FreeSid AllocateAndInitializeSid RegDeleteKeyA EqualSid RegSetValueExA GetTokenInformation OpenProcessToken RegCloseKey

shell32

SHChangeNotify ord680 ShellExecuteA

wininet

HttpOpenRequestA InternetOpenUrlA HttpSendRequestA InternetOpenA InternetCloseHandle InternetConnectA InternetReadFile

Sharing