General
-
Target
4b79eefd54c9cf25f25601a3749d08ee7e1df3bedee90840b0739a6a54e0fc07
-
Size
101KB
-
Sample
240420-1pefnabd6z
-
MD5
a9f5ad33677f3d3f72f9707b145b258f
-
SHA1
ac145da3864b6628fd4639f10e97eda21937e0e7
-
SHA256
4b79eefd54c9cf25f25601a3749d08ee7e1df3bedee90840b0739a6a54e0fc07
-
SHA512
ee306149d514591acc1678a67bd5e188ac80d5d9e5fb14ed5da72e76e5c350bcec5910205d8f83e168d71402c4d5183f23c43b8ec9ea1b7b417141e7c8eeb53c
-
SSDEEP
1536:zJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrXv/w:dbfVk29te2jqxCEtg30BU
Behavioral task
behavioral1
Sample
4b79eefd54c9cf25f25601a3749d08ee7e1df3bedee90840b0739a6a54e0fc07.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4b79eefd54c9cf25f25601a3749d08ee7e1df3bedee90840b0739a6a54e0fc07.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
sakula
www.savmpet.com
Targets
-
-
Target
4b79eefd54c9cf25f25601a3749d08ee7e1df3bedee90840b0739a6a54e0fc07
-
Size
101KB
-
MD5
a9f5ad33677f3d3f72f9707b145b258f
-
SHA1
ac145da3864b6628fd4639f10e97eda21937e0e7
-
SHA256
4b79eefd54c9cf25f25601a3749d08ee7e1df3bedee90840b0739a6a54e0fc07
-
SHA512
ee306149d514591acc1678a67bd5e188ac80d5d9e5fb14ed5da72e76e5c350bcec5910205d8f83e168d71402c4d5183f23c43b8ec9ea1b7b417141e7c8eeb53c
-
SSDEEP
1536:zJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrXv/w:dbfVk29te2jqxCEtg30BU
Score10/10-
Sakula payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-