General
-
Target
NEAS.280b4761b5389061dc7bf992a83c11d0_JC.exe
-
Size
92KB
-
Sample
231017-zr631sha4v
-
MD5
280b4761b5389061dc7bf992a83c11d0
-
SHA1
fa613d403ed14ebd384fcc6ed986b442b0e443be
-
SHA256
1ca4d91b8df358b7d3fbf7c96ef104328554608de7892e05fb8c81474112ffcd
-
SHA512
20f55909fa7ee67c60e12e7f537520c3dbbca7934d2c74d15505e9982b3dcd2fc3d61fb7905442236c9d6d201448e0e631574c75649a4d84f51b71dbb19c1afc
-
SSDEEP
1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrs:9bfVk29te2jqxCEtg30BA
Behavioral task
behavioral1
Sample
NEAS.280b4761b5389061dc7bf992a83c11d0_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.280b4761b5389061dc7bf992a83c11d0_JC.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
sakula
www.savmpet.com
Targets
-
-
Target
NEAS.280b4761b5389061dc7bf992a83c11d0_JC.exe
-
Size
92KB
-
MD5
280b4761b5389061dc7bf992a83c11d0
-
SHA1
fa613d403ed14ebd384fcc6ed986b442b0e443be
-
SHA256
1ca4d91b8df358b7d3fbf7c96ef104328554608de7892e05fb8c81474112ffcd
-
SHA512
20f55909fa7ee67c60e12e7f537520c3dbbca7934d2c74d15505e9982b3dcd2fc3d61fb7905442236c9d6d201448e0e631574c75649a4d84f51b71dbb19c1afc
-
SSDEEP
1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrs:9bfVk29te2jqxCEtg30BA
Score10/10-
Sakula payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-