General
-
Target
c927d9a32b54749834b7c252fdd8c4001fb184109ec2cd11ca3e6d8e0ba5d537
-
Size
100KB
-
Sample
240419-der8fafg9w
-
MD5
86a806fd40b6251ba62e416398f4daca
-
SHA1
ced8777d6c6b4119e9a773dd3021ad96fa921284
-
SHA256
c927d9a32b54749834b7c252fdd8c4001fb184109ec2cd11ca3e6d8e0ba5d537
-
SHA512
2569b606167820f7be6f2a64fc94adb234c815f07723714894f9a524885f476741cac5eeec850ca98b58f3c8ec0144b80253c689b557e0979968074ea8cc6078
-
SSDEEP
1536:kJb2fJVkgeRTvitTkjoRXGxz2CXxd7VP8xCEtkz30rtraOjLY:ibWVk7utEH7GxCEtg30BP8
Behavioral task
behavioral1
Sample
c927d9a32b54749834b7c252fdd8c4001fb184109ec2cd11ca3e6d8e0ba5d537.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c927d9a32b54749834b7c252fdd8c4001fb184109ec2cd11ca3e6d8e0ba5d537.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
sakula
www.savmpet.com
Targets
-
-
Target
c927d9a32b54749834b7c252fdd8c4001fb184109ec2cd11ca3e6d8e0ba5d537
-
Size
100KB
-
MD5
86a806fd40b6251ba62e416398f4daca
-
SHA1
ced8777d6c6b4119e9a773dd3021ad96fa921284
-
SHA256
c927d9a32b54749834b7c252fdd8c4001fb184109ec2cd11ca3e6d8e0ba5d537
-
SHA512
2569b606167820f7be6f2a64fc94adb234c815f07723714894f9a524885f476741cac5eeec850ca98b58f3c8ec0144b80253c689b557e0979968074ea8cc6078
-
SSDEEP
1536:kJb2fJVkgeRTvitTkjoRXGxz2CXxd7VP8xCEtkz30rtraOjLY:ibWVk7utEH7GxCEtg30BP8
Score10/10-
Sakula payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-