General
-
Target
131820b0078c9a47260d89e693de314f6c83ca501c2ba3b79373003f412a181d
-
Size
150KB
-
Sample
220212-fzvkeagdd8
-
MD5
c2ef42bef2e5b16ab7950a88f99c55f2
-
SHA1
4240e039005ae84cb23e8d89cbb4e8d8e5e2601e
-
SHA256
131820b0078c9a47260d89e693de314f6c83ca501c2ba3b79373003f412a181d
-
SHA512
f892f4c59ec076ef86e8e48ddd703329268eb550aa39f238a04d9f5f41a56eac5fb070c0fa228349fc3cdfeb261526dad5e2e979cba753d48c42c04858d30f28
Static task
static1
Behavioral task
behavioral1
Sample
131820b0078c9a47260d89e693de314f6c83ca501c2ba3b79373003f412a181d.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
131820b0078c9a47260d89e693de314f6c83ca501c2ba3b79373003f412a181d.exe
Resource
win10v2004-en-20220113
Malware Config
Targets
-
-
Target
131820b0078c9a47260d89e693de314f6c83ca501c2ba3b79373003f412a181d
-
Size
150KB
-
MD5
c2ef42bef2e5b16ab7950a88f99c55f2
-
SHA1
4240e039005ae84cb23e8d89cbb4e8d8e5e2601e
-
SHA256
131820b0078c9a47260d89e693de314f6c83ca501c2ba3b79373003f412a181d
-
SHA512
f892f4c59ec076ef86e8e48ddd703329268eb550aa39f238a04d9f5f41a56eac5fb070c0fa228349fc3cdfeb261526dad5e2e979cba753d48c42c04858d30f28
Score10/10-
Sakula Payload
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Adds Run key to start application
-