General
-
Target
d047b52ee754cea21227319b12a5b960_exe32.exe
-
Size
212KB
-
Sample
231015-yhag1sfb7x
-
MD5
d047b52ee754cea21227319b12a5b960
-
SHA1
f753297a77a41ff97cf3010cf0fb916170687647
-
SHA256
91b8f3cb9a30b6bd4a2e0a4a5ffecb9fe4afb95042ebbc90e8fa860e318e7423
-
SHA512
45143aacebc9dda69e7f81fddbc683b722b0f386d25a81c4721842d5321ca7fe8f6e88c2694346c2d0d7eed5a88b4993c733e51ce82287b13be5352ad9223c61
-
SSDEEP
1536:NtQFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX++pdz30rtr8gjXjp0GanB2:A29DkEGRQixVSjLc130BYgjXjpUnB2
Behavioral task
behavioral1
Sample
d047b52ee754cea21227319b12a5b960_exe32.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
d047b52ee754cea21227319b12a5b960_exe32.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
sakula
www.polarroute.com
Targets
-
-
Target
d047b52ee754cea21227319b12a5b960_exe32.exe
-
Size
212KB
-
MD5
d047b52ee754cea21227319b12a5b960
-
SHA1
f753297a77a41ff97cf3010cf0fb916170687647
-
SHA256
91b8f3cb9a30b6bd4a2e0a4a5ffecb9fe4afb95042ebbc90e8fa860e318e7423
-
SHA512
45143aacebc9dda69e7f81fddbc683b722b0f386d25a81c4721842d5321ca7fe8f6e88c2694346c2d0d7eed5a88b4993c733e51ce82287b13be5352ad9223c61
-
SSDEEP
1536:NtQFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX++pdz30rtr8gjXjp0GanB2:A29DkEGRQixVSjLc130BYgjXjpUnB2
Score10/10-
Sakula payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-