General
-
Target
f75791e9025197dfa0bd0e2c35fdcf5f66cfcb5e41b549f0fcf519cd727da8e6
-
Size
101KB
-
Sample
240421-feyfkabf69
-
MD5
2541ce1125513be9d0edf297910148bd
-
SHA1
1975063d0fb176dd023ca5858a141cc5d055ac5e
-
SHA256
f75791e9025197dfa0bd0e2c35fdcf5f66cfcb5e41b549f0fcf519cd727da8e6
-
SHA512
1e9816023564e3249868a78c0f860d80043fb75358ec6bb13b553dd8f31963fba2b85867dfb80f55629b37befa7165959baa271578dcbcb3032241501860c5c1
-
SSDEEP
1536:9JbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrfPTEzo:/bfVk29te2jqxCEtg30BLbEc
Behavioral task
behavioral1
Sample
f75791e9025197dfa0bd0e2c35fdcf5f66cfcb5e41b549f0fcf519cd727da8e6.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f75791e9025197dfa0bd0e2c35fdcf5f66cfcb5e41b549f0fcf519cd727da8e6.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
sakula
www.savmpet.com
Targets
-
-
Target
f75791e9025197dfa0bd0e2c35fdcf5f66cfcb5e41b549f0fcf519cd727da8e6
-
Size
101KB
-
MD5
2541ce1125513be9d0edf297910148bd
-
SHA1
1975063d0fb176dd023ca5858a141cc5d055ac5e
-
SHA256
f75791e9025197dfa0bd0e2c35fdcf5f66cfcb5e41b549f0fcf519cd727da8e6
-
SHA512
1e9816023564e3249868a78c0f860d80043fb75358ec6bb13b553dd8f31963fba2b85867dfb80f55629b37befa7165959baa271578dcbcb3032241501860c5c1
-
SSDEEP
1536:9JbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrfPTEzo:/bfVk29te2jqxCEtg30BLbEc
Score10/10-
Sakula payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-