General
-
Target
NEAS.1c415d918b7244f6ade68f641435df50_JC.exe
-
Size
212KB
-
Sample
231101-xrazgaca5s
-
MD5
1c415d918b7244f6ade68f641435df50
-
SHA1
db847e38e19543ab52965ded083105f1c9a5b033
-
SHA256
59fc9b0d6bb6a912f13dde90f409ee514a3482c0c9da0af2380daadbf54eceb6
-
SHA512
21749506622aa39e7f4e4ade73942db218e631259dd3a97d872820dd8e0571af012146156f58014cbd06a48bb81b1979b8215ce6ac424422b6bd989e8a667d8c
-
SSDEEP
1536:NtQFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX++pdz30rtr8gjXjp0GanBe:A29DkEGRQixVSjLc130BYgjXjpUnBe
Behavioral task
behavioral1
Sample
NEAS.1c415d918b7244f6ade68f641435df50_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.1c415d918b7244f6ade68f641435df50_JC.exe
Resource
win10v2004-20231023-en
Malware Config
Extracted
sakula
www.polarroute.com
Targets
-
-
Target
NEAS.1c415d918b7244f6ade68f641435df50_JC.exe
-
Size
212KB
-
MD5
1c415d918b7244f6ade68f641435df50
-
SHA1
db847e38e19543ab52965ded083105f1c9a5b033
-
SHA256
59fc9b0d6bb6a912f13dde90f409ee514a3482c0c9da0af2380daadbf54eceb6
-
SHA512
21749506622aa39e7f4e4ade73942db218e631259dd3a97d872820dd8e0571af012146156f58014cbd06a48bb81b1979b8215ce6ac424422b6bd989e8a667d8c
-
SSDEEP
1536:NtQFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX++pdz30rtr8gjXjp0GanBe:A29DkEGRQixVSjLc130BYgjXjpUnBe
Score10/10-
Sakula payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-