General
-
Target
82aeb13896c15e4a85acd0b85c763c0d
-
Size
92KB
-
Sample
231219-x25ltsebc9
-
MD5
82aeb13896c15e4a85acd0b85c763c0d
-
SHA1
61e442bc28dceaf970a74a40cdbfa2c916f29cb9
-
SHA256
a98e2e6adf0ebce55f4a665be274cde21a678b3d24a3574cfe57a31d0514c0bb
-
SHA512
50cd5f6663d20f1ac309003187fd054eb4a1852121bf08381c03f44cf80e4844dac11f79cd3436a908644b95d8de45f27468be0f75882ff15b3ab4fe29a227b1
-
SSDEEP
1536:PQFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX+ees52z30rtry:w29DkEGRQixVSjLaes5G30BG
Behavioral task
behavioral1
Sample
82aeb13896c15e4a85acd0b85c763c0d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
82aeb13896c15e4a85acd0b85c763c0d.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
sakula
www.polarroute.com
Targets
-
-
Target
82aeb13896c15e4a85acd0b85c763c0d
-
Size
92KB
-
MD5
82aeb13896c15e4a85acd0b85c763c0d
-
SHA1
61e442bc28dceaf970a74a40cdbfa2c916f29cb9
-
SHA256
a98e2e6adf0ebce55f4a665be274cde21a678b3d24a3574cfe57a31d0514c0bb
-
SHA512
50cd5f6663d20f1ac309003187fd054eb4a1852121bf08381c03f44cf80e4844dac11f79cd3436a908644b95d8de45f27468be0f75882ff15b3ab4fe29a227b1
-
SSDEEP
1536:PQFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX+ees52z30rtry:w29DkEGRQixVSjLaes5G30BG
Score10/10-
Sakula payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-