File name:	2025-05-15_a450ec7a520be6b1735bd20fdef2385c_amadey_elex_rhadamanthys_sakula_smoke-loader
Full analysis:	https://app.any.run/tasks/f08496d2-dfd2-4460-8d14-8dbfc79bbe8a
Verdict:	Malicious activity
Threats:	Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. Malware Trends Tracker >>>
Analysis date:	May 15, 2025, 21:18:03
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	rat mivast sakula auto-reg
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	A450EC7A520BE6B1735BD20FDEF2385C
SHA1:	D655B3C826538ED63182E66DB11978EBD0B52A14
SHA256:	9596A8D173CDB4EDAA3DE84F9186C211E66F5AF9A2E35EE2BE35EFFB80198CB4
SSDEEP:	6144:QFPUkOn3ZYcJ67wdHMgkP89PHA2u/z08bIHHHxzSLT6vw6HEGVKlTsfLtZPW3pH9:SPdOpYeywlI0dLwXbHYABJ

.exe	\|	Win32 Executable (generic) (52.9)
.exe	\|	Generic Win/DOS Executable (23.5)
.exe	\|	DOS Executable Generic (23.5)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2013:02:05 04:03:07+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	9
CodeSize:	56320
InitializedDataSize:	33792
UninitializedDataSize:	-
EntryPoint:	0x473a
OSVersion:	5
ImageVersion:	-
SubsystemVersion:	5
Subsystem:	Windows GUI


(PID) Process:	(6372) 2025-05-15_a450ec7a520be6b1735bd20fdef2385c_amadey_elex_rhadamanthys_sakula_smoke-loader.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:	write	Name:	MicroMedia
Value: C:\Users\admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
(PID) Process:	(4040) MediaCenter.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(4040) MediaCenter.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(4040) MediaCenter.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:
(PID) Process:	(1228) MediaCenter.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(1228) MediaCenter.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(1228) MediaCenter.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:

PID	Process	Filename		Type
4040	MediaCenter.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\viewphoto[1].htm		html
		MD5:B1D081C70AB8B8D4684C1DA4CC62A14F	SHA256:2C845FAEECE4DDB1AB11BA942E3549D4601F69FA2D5A200ECC918CC3E521B473
1228	MediaCenter.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\viewphoto[1].htm		html
		MD5:8E69859E8440AABD4A415A1067E3C3F9	SHA256:BA6494D459F22D89CEA71F3F07110B91B97CB9C2823BE9CA09984C2A4401CC50
4040	MediaCenter.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\qrfxgbctwtyywyq649566714[1].htm		html
		MD5:14D4E9DDE9E9C4012A1689BC7412B39D	SHA256:7116837B16E5A1241951E594D132F7D61B776902930B2FB0A643576732E052FB
1228	MediaCenter.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\qrfxgbctwtyywyq649566714[1].htm		html
		MD5:772FBDB2CBDE324605757A9F2AA18CE7	SHA256:E00E4608D7370EC0FB4F80C0689BD712F02AE9342361813BF2919A957D70853E
6372	2025-05-15_a450ec7a520be6b1735bd20fdef2385c_amadey_elex_rhadamanthys_sakula_smoke-loader.exe	C:\Users\admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe		executable
		MD5:C961370DCD286719FEDA5D790F866117	SHA256:4BAC3EB46E7B1AA3F76CFEC22916C6F9066DBF5CD7F2E8794611004456C3C99D

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
4040	MediaCenter.exe	POST	405	76.223.54.146:80	http://www.polarroute.com/newimage.asp?imageid=qrfxgbctwtyywyq649566714&type=0&resid=1098093	unknown	—	—	malicious
4040	MediaCenter.exe	GET	200	76.223.54.146:80	http://www.polarroute.com/photo/qrfxgbctwtyywyq649566714.jpg?resid=1100375	unknown	—	—	malicious
1228	MediaCenter.exe	POST	405	76.223.54.146:80	http://www.polarroute.com/newimage.asp?imageid=qrfxgbctwtyywyq649566714&type=0&resid=1101609	unknown	—	—	malicious
4040	MediaCenter.exe	GET	200	76.223.54.146:80	http://www.polarroute.com/viewphoto.asp?resid=1100531&photoid=qrfxgbctwtyywyq649566714	unknown	—	—	malicious
1228	MediaCenter.exe	GET	200	76.223.54.146:80	http://www.polarroute.com/photo/qrfxgbctwtyywyq649566714.jpg?resid=1101984	unknown	—	—	malicious
1228	MediaCenter.exe	GET	200	76.223.54.146:80	http://www.polarroute.com/viewphoto.asp?resid=1102140&photoid=qrfxgbctwtyywyq649566714	unknown	—	—	malicious
1228	MediaCenter.exe	GET	200	76.223.54.146:80	http://www.polarroute.com/viewphoto.asp?resid=1133718&photoid=qrfxgbctwtyywyq649566714	unknown	—	—	malicious
1228	MediaCenter.exe	GET	200	76.223.54.146:80	http://www.polarroute.com/photo/qrfxgbctwtyywyq649566714.jpg?resid=1133593	unknown	—	—	malicious
4040	MediaCenter.exe	POST	405	76.223.54.146:80	http://www.polarroute.com/newimage.asp?imageid=qrfxgbctwtyywyq649566714&type=0&resid=1131703	unknown	—	—	malicious
4040	MediaCenter.exe	GET	200	76.223.54.146:80	http://www.polarroute.com/viewphoto.asp?resid=1132109&photoid=qrfxgbctwtyywyq649566714	unknown	—	—	malicious

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
—	—	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
4040	MediaCenter.exe	76.223.54.146:80	www.polarroute.com	AMAZON-02	US	malicious
1228	MediaCenter.exe	76.223.54.146:80	www.polarroute.com	AMAZON-02	US	malicious
1452	slui.exe	20.83.72.98:443	activation-v2.sls.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
2316	slui.exe	40.91.76.224:443	activation-v2.sls.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	20.73.194.208	whitelisted
google.com	142.250.185.174	whitelisted
www.polarroute.com	76.223.54.146 13.248.169.48	malicious
activation-v2.sls.microsoft.com	20.83.72.98 40.91.76.224	whitelisted

PID	Process	Class	Message
4040	MediaCenter.exe	Potentially Bad Traffic	ET HUNTING SUSPICIOUS UA (iexplore)
4040	MediaCenter.exe	Potentially Bad Traffic	ET HUNTING SUSPICIOUS UA (iexplore)
4040	MediaCenter.exe	Potentially Bad Traffic	ET HUNTING SUSPICIOUS UA (iexplore)
4040	MediaCenter.exe	Malware Command and Control Activity Detected	ET MALWARE Sakula/Mivast RAT CnC Beacon 1
4040	MediaCenter.exe	Malware Command and Control Activity Detected	ET MALWARE Sakula/Mivast RAT CnC Beacon 2
4040	MediaCenter.exe	Malware Command and Control Activity Detected	ET MALWARE Sakula/Mivast RAT CnC Beacon 3
1228	MediaCenter.exe	Potentially Bad Traffic	ET HUNTING SUSPICIOUS UA (iexplore)
1228	MediaCenter.exe	Potentially Bad Traffic	ET HUNTING SUSPICIOUS UA (iexplore)
1228	MediaCenter.exe	Malware Command and Control Activity Detected	ET MALWARE Sakula/Mivast RAT CnC Beacon 1
1228	MediaCenter.exe	Malware Command and Control Activity Detected	ET MALWARE Sakula/Mivast RAT CnC Beacon 2

General Info

2025-05-15_a450ec7a520be6b1735bd20fdef2385c_amadey_elex_rhadamanthys_sakula_smoke-loader

A450EC7A520BE6B1735BD20FDEF2385C

D655B3C826538ED63182E66DB11978EBD0B52A14

9596A8D173CDB4EDAA3DE84F9186C211E66F5AF9A2E35EE2BE35EFFB80198CB4

6144:QFPUkOn3ZYcJ67wdHMgkP89PHA2u/z08bIHHHxzSLT6vw6HEGVKlTsfLtZPW3pH9:SPdOpYeywlI0dLwXbHYABJ

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Changes the autorun value in the registry

SAKULA has been detected

SAKULA has been detected (SURICATA)

Connects to the CnC server

SAKULA has been detected (YARA)

Starts CMD.EXE for self-deleting

SUSPICIOUS

Executable content was dropped or overwritten

Starts itself from another location

Reads security settings of Internet Explorer

Contacting a server suspected of hosting an CnC

Starts CMD.EXE for commands execution

INFO

Checks supported languages

Create files in a temporary directory

Reads the computer name

Auto-launch of the file from Registry key

Creates files or folders in the user directory

Checks proxy server information

Manual execution by a user

Reads the software policy settings

Process checks computer location settings

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings