General
-
Target
99583c439fc950e425f3dc8c06cba936
-
Size
392KB
-
Sample
231219-zj6ghsgfcm
-
MD5
99583c439fc950e425f3dc8c06cba936
-
SHA1
07021f9f46fb44e784da837aeeecec9ee6597f7c
-
SHA256
17f53b9d55848d903786c987157816c97bcb3304cc06b4b98bed561159245f34
-
SHA512
75ec2d697a49e4eabe13671f5b826c30017d5056be7ceeb2f6c1d7ffc2dd293cc3a7fd918a7045241d47e95b89f006eb3f060222c621384dae3ca8692a9cd84f
-
SSDEEP
6144:M29qRfVSndj30B3wBxE1+ijiBKk3etdgI2MyzNORQtOfl1qNVo7R+S+N/TU7kn5e:0RfQn+w8EYiBlMkn5f9J105r
Behavioral task
behavioral1
Sample
99583c439fc950e425f3dc8c06cba936.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
99583c439fc950e425f3dc8c06cba936.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
sakula
www.polarroute.com
Targets
-
-
Target
99583c439fc950e425f3dc8c06cba936
-
Size
392KB
-
MD5
99583c439fc950e425f3dc8c06cba936
-
SHA1
07021f9f46fb44e784da837aeeecec9ee6597f7c
-
SHA256
17f53b9d55848d903786c987157816c97bcb3304cc06b4b98bed561159245f34
-
SHA512
75ec2d697a49e4eabe13671f5b826c30017d5056be7ceeb2f6c1d7ffc2dd293cc3a7fd918a7045241d47e95b89f006eb3f060222c621384dae3ca8692a9cd84f
-
SSDEEP
6144:M29qRfVSndj30B3wBxE1+ijiBKk3etdgI2MyzNORQtOfl1qNVo7R+S+N/TU7kn5e:0RfQn+w8EYiBlMkn5f9J105r
Score10/10-
Sakula payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-