General

  • Target

    87d06905f2500890a9570349d0fa41b5_JC.exe

  • Size

    212KB

  • Sample

    231005-xjle8sec2x

  • MD5

    87d06905f2500890a9570349d0fa41b5

  • SHA1

    0e168a8d31675dc74e94151b49d41ff0a15edfe9

  • SHA256

    250aa08ddde94ec8b7c23cbeee5e0fc58f4ff5e54fb04b9fe28bac1fadabfa2b

  • SHA512

    c01f7c5d88b76140a8cac9b4be71eb436f6d1bede1d7386a4fff3a9ebcb59b88e7768cd591af19d6c70c3551af25488f408ba00f6816b0ab977810bed3fc6a69

  • SSDEEP

    1536:6QFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX+Zhz30rtr8gjXjp0FanB8:x29DkEGRQixVSjLF530BYgjXjpvnB8

Malware Config

Extracted

Family

sakula

C2

www.polarroute.com

Targets

    • Target

      87d06905f2500890a9570349d0fa41b5_JC.exe

    • Size

      212KB

    • MD5

      87d06905f2500890a9570349d0fa41b5

    • SHA1

      0e168a8d31675dc74e94151b49d41ff0a15edfe9

    • SHA256

      250aa08ddde94ec8b7c23cbeee5e0fc58f4ff5e54fb04b9fe28bac1fadabfa2b

    • SHA512

      c01f7c5d88b76140a8cac9b4be71eb436f6d1bede1d7386a4fff3a9ebcb59b88e7768cd591af19d6c70c3551af25488f408ba00f6816b0ab977810bed3fc6a69

    • SSDEEP

      1536:6QFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX+Zhz30rtr8gjXjp0FanB8:x29DkEGRQixVSjLF530BYgjXjpvnB8

    • Sakula

      Sakula is a remote access trojan with various capabilities.

    • Sakula payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks