File name:	2025-04-24_86ba5706b14e35e9fa38b971fa027793_amadey_elex_rhadamanthys_sakula_smoke-loader
Full analysis:	https://app.any.run/tasks/47121c6e-5779-481c-9ddc-5cbf0fcb05c5
Verdict:	Malicious activity
Threats:	Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. Malware Trends Tracker >>>
Analysis date:	April 24, 2025, 06:04:04
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	rat mivast sakula auto-reg
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	86BA5706B14E35E9FA38B971FA027793
SHA1:	052AD0B7D95855C3DA0DB504B898B113086F9D9E
SHA256:	F7DEAB18A739A42ECA8617342AB37C86DBFE86448D99CEA72B6B0D52E624B46E
SSDEEP:	1536:MDFdm050yuiRUkzTs4sGXOnjENkZYYeCCIjTX2aJEVHuc5xAE5c:iFuiRUfMOnINkZYFIjTX2E6uc5a

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2013:02:05 04:03:07+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	9
CodeSize:	56320
InitializedDataSize:	33792
UninitializedDataSize:	-
EntryPoint:	0x473a
OSVersion:	5
ImageVersion:	-
SubsystemVersion:	5
Subsystem:	Windows GUI


(PID) Process:	(3900) 2025-04-24_86ba5706b14e35e9fa38b971fa027793_amadey_elex_rhadamanthys_sakula_smoke-loader.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:	write	Name:	MicroMedia
Value: C:\Users\admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
(PID) Process:	(5892) MediaCenter.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(5892) MediaCenter.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(5892) MediaCenter.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:
(PID) Process:	(4452) MediaCenter.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(4452) MediaCenter.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(4452) MediaCenter.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:

PID	Process	Filename		Type
4452	MediaCenter.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\qrfxgbctwtyywyq649566714[1].htm		html
		MD5:DD1583FBAE66B41CD1421A10306B79C8	SHA256:00CD2777AE206DA807DE6E464059F79DB46E0A7F25C4CC1959D0E39B97130BA0
5892	MediaCenter.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\viewphoto[1].htm		html
		MD5:D7611C5766CDDA35C90D393CD78441F3	SHA256:7314055599F80939C484206ABFF01F3F99E5D093C523DB96F9C886A52655032B
3900	2025-04-24_86ba5706b14e35e9fa38b971fa027793_amadey_elex_rhadamanthys_sakula_smoke-loader.exe	C:\Users\admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe		executable
		MD5:395395DC1BF58B1C80B89715CE00819C	SHA256:3BD90A1E1FEFBEB16685E9D19D7660D4F9FD87A441DE018B0B7AA06CDB511C4A
4452	MediaCenter.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\viewphoto[1].htm		html
		MD5:5FF19C72E7A3339B7DBABBE9B8A4FCB7	SHA256:59618E090EFF99E4C16B724F7CEC9147D4F14D8EF338B3DA7FD92DBE5FEDC685
5892	MediaCenter.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\qrfxgbctwtyywyq649566714[1].htm		html
		MD5:87B010E68BB73CC20F45EAC4DCC701FE	SHA256:C0D91F31BD41E158B3A486BD55A526BDAFD88550D9F936BAAFB34091D06C461B

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
4452	MediaCenter.exe	GET	200	13.248.169.48:80	http://www.polarroute.com/viewphoto.asp?resid=1104875&photoid=qrfxgbctwtyywyq649566714	unknown	—	—	malicious
4452	MediaCenter.exe	POST	405	13.248.169.48:80	http://www.polarroute.com/newimage.asp?imageid=qrfxgbctwtyywyq649566714&type=0&resid=1103062	unknown	—	—	malicious
5892	MediaCenter.exe	GET	200	13.248.169.48:80	http://www.polarroute.com/viewphoto.asp?resid=1098000&photoid=qrfxgbctwtyywyq649566714	unknown	—	—	malicious
5892	MediaCenter.exe	POST	405	13.248.169.48:80	http://www.polarroute.com/newimage.asp?imageid=qrfxgbctwtyywyq649566714&type=0&resid=1096968	unknown	—	—	malicious
5892	MediaCenter.exe	GET	200	13.248.169.48:80	http://www.polarroute.com/photo/qrfxgbctwtyywyq649566714.jpg?resid=1097781	unknown	—	—	malicious
4452	MediaCenter.exe	GET	200	13.248.169.48:80	http://www.polarroute.com/photo/qrfxgbctwtyywyq649566714.jpg?resid=1104625	unknown	—	—	malicious
5892	MediaCenter.exe	POST	405	13.248.169.48:80	http://www.polarroute.com/newimage.asp?imageid=qrfxgbctwtyywyq649566714&type=0&resid=1129328	unknown	—	—	malicious
5892	MediaCenter.exe	GET	200	13.248.169.48:80	http://www.polarroute.com/viewphoto.asp?resid=1129953&photoid=qrfxgbctwtyywyq649566714	unknown	—	—	malicious
5892	MediaCenter.exe	GET	200	13.248.169.48:80	http://www.polarroute.com/photo/qrfxgbctwtyywyq649566714.jpg?resid=1129734	unknown	—	—	malicious
4452	MediaCenter.exe	POST	405	13.248.169.48:80	http://www.polarroute.com/newimage.asp?imageid=qrfxgbctwtyywyq649566714&type=0&resid=1136093	unknown	—	—	malicious

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	192.168.100.255:137	—	—	—	whitelisted
—	—	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5892	MediaCenter.exe	13.248.169.48:80	www.polarroute.com	AMAZON-02	US	malicious
4452	MediaCenter.exe	13.248.169.48:80	www.polarroute.com	AMAZON-02	US	malicious
6620	slui.exe	40.91.76.224:443	activation-v2.sls.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
3216	svchost.exe	172.211.123.249:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	FR	whitelisted
6676	SIHClient.exe	52.149.20.212:443	slscr.update.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
6676	SIHClient.exe	2.16.164.72:80	crl.microsoft.com	Akamai International B.V.	NL	whitelisted
6676	SIHClient.exe	2.23.246.101:80	www.microsoft.com	Ooredoo Q.S.C.	QA	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2	whitelisted
google.com	142.250.181.238	whitelisted
www.polarroute.com	13.248.169.48 76.223.54.146	malicious
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted
client.wns.windows.com	172.211.123.249	whitelisted
nexusrules.officeapps.live.com	52.111.229.19	whitelisted
slscr.update.microsoft.com	52.149.20.212	whitelisted
crl.microsoft.com	2.16.164.72 2.16.164.49 2.16.164.106	whitelisted
www.microsoft.com	2.23.246.101	whitelisted
fe3cr.delivery.mp.microsoft.com	40.69.42.241	whitelisted

PID	Process	Class	Message
5892	MediaCenter.exe	Potentially Bad Traffic	ET HUNTING SUSPICIOUS UA (iexplore)
5892	MediaCenter.exe	Potentially Bad Traffic	ET HUNTING SUSPICIOUS UA (iexplore)
5892	MediaCenter.exe	Malware Command and Control Activity Detected	ET MALWARE Sakula/Mivast RAT CnC Beacon 2
5892	MediaCenter.exe	Malware Command and Control Activity Detected	ET MALWARE Sakula/Mivast RAT CnC Beacon 1
5892	MediaCenter.exe	Potentially Bad Traffic	ET HUNTING SUSPICIOUS UA (iexplore)
5892	MediaCenter.exe	Malware Command and Control Activity Detected	ET MALWARE Sakula/Mivast RAT CnC Beacon 3
4452	MediaCenter.exe	Potentially Bad Traffic	ET HUNTING SUSPICIOUS UA (iexplore)
4452	MediaCenter.exe	Malware Command and Control Activity Detected	ET MALWARE Sakula/Mivast RAT CnC Beacon 1
4452	MediaCenter.exe	Potentially Bad Traffic	ET HUNTING SUSPICIOUS UA (iexplore)
4452	MediaCenter.exe	Potentially Bad Traffic	ET HUNTING SUSPICIOUS UA (iexplore)

General Info

2025-04-24_86ba5706b14e35e9fa38b971fa027793_amadey_elex_rhadamanthys_sakula_smoke-loader

86BA5706B14E35E9FA38B971FA027793

052AD0B7D95855C3DA0DB504B898B113086F9D9E

F7DEAB18A739A42ECA8617342AB37C86DBFE86448D99CEA72B6B0D52E624B46E

1536:MDFdm050yuiRUkzTs4sGXOnjENkZYYeCCIjTX2aJEVHuc5xAE5c:iFuiRUfMOnINkZYFIjTX2E6uc5a

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SAKULA has been detected

Changes the autorun value in the registry

SAKULA has been detected (SURICATA)

Connects to the CnC server

SAKULA has been detected (YARA)

Starts CMD.EXE for self-deleting

SUSPICIOUS

Starts itself from another location

Executable content was dropped or overwritten

Reads security settings of Internet Explorer

Contacting a server suspected of hosting an CnC

Starts CMD.EXE for commands execution

INFO

Create files in a temporary directory

Checks supported languages

Reads the computer name

Auto-launch of the file from Registry key

Checks proxy server information

Creates files or folders in the user directory

Manual execution by a user

Reads the software policy settings

Process checks computer location settings

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings