General
-
Target
c8e1a9d4535e2f001e51e73616b9b7cc3d211e3c05dab9648ac010d7d7e60706
-
Size
332KB
-
Sample
240409-ct3r2sfc21
-
MD5
eeed29de646b7ade52ed223077999eba
-
SHA1
3817f8271a077bcf264bf395ff66aea8a037306f
-
SHA256
c8e1a9d4535e2f001e51e73616b9b7cc3d211e3c05dab9648ac010d7d7e60706
-
SHA512
d599fe4e74d9d7bfd12e46b2b4a36e4073a2929066310a082f549c4a14a6d42e2e3dccb445fff8cd9d093ac79b836f50b6143da17116fdd030a5486e3c63f050
-
SSDEEP
6144:Nj9c2WYd30BKmiPVpU3ypIPr3D3StNynyS/d:NSI2HZ
Behavioral task
behavioral1
Sample
c8e1a9d4535e2f001e51e73616b9b7cc3d211e3c05dab9648ac010d7d7e60706.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c8e1a9d4535e2f001e51e73616b9b7cc3d211e3c05dab9648ac010d7d7e60706.exe
Resource
win10v2004-20240319-en
Malware Config
Extracted
sakula
www.savmpet.com
Targets
-
-
Target
c8e1a9d4535e2f001e51e73616b9b7cc3d211e3c05dab9648ac010d7d7e60706
-
Size
332KB
-
MD5
eeed29de646b7ade52ed223077999eba
-
SHA1
3817f8271a077bcf264bf395ff66aea8a037306f
-
SHA256
c8e1a9d4535e2f001e51e73616b9b7cc3d211e3c05dab9648ac010d7d7e60706
-
SHA512
d599fe4e74d9d7bfd12e46b2b4a36e4073a2929066310a082f549c4a14a6d42e2e3dccb445fff8cd9d093ac79b836f50b6143da17116fdd030a5486e3c63f050
-
SSDEEP
6144:Nj9c2WYd30BKmiPVpU3ypIPr3D3StNynyS/d:NSI2HZ
Score10/10-
Sakula payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-