General
-
Target
f8c54dcea005529983111f85abe5bfac02d814ad8e92aeaf9a0355ed042f1b4c
-
Size
92KB
-
Sample
240423-gnjt7sdh9t
-
MD5
b3deb0963c4c157547f49524a6cc5f5b
-
SHA1
b84ea8923d65f53d50285894cf0d6f17c22fcdb0
-
SHA256
f8c54dcea005529983111f85abe5bfac02d814ad8e92aeaf9a0355ed042f1b4c
-
SHA512
373c66d8da83319f95a9453f55a84a21ceaca7bb9d745ce13423be72e231c86d092f69db265782424f1a3ef4ecd7968301cf2e2a90f01ce73a4de3ff002d267e
-
SSDEEP
1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrx:9bfVk29te2jqxCEtg30Bd
Behavioral task
behavioral1
Sample
f8c54dcea005529983111f85abe5bfac02d814ad8e92aeaf9a0355ed042f1b4c.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
f8c54dcea005529983111f85abe5bfac02d814ad8e92aeaf9a0355ed042f1b4c.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
sakula
www.savmpet.com
Targets
-
-
Target
f8c54dcea005529983111f85abe5bfac02d814ad8e92aeaf9a0355ed042f1b4c
-
Size
92KB
-
MD5
b3deb0963c4c157547f49524a6cc5f5b
-
SHA1
b84ea8923d65f53d50285894cf0d6f17c22fcdb0
-
SHA256
f8c54dcea005529983111f85abe5bfac02d814ad8e92aeaf9a0355ed042f1b4c
-
SHA512
373c66d8da83319f95a9453f55a84a21ceaca7bb9d745ce13423be72e231c86d092f69db265782424f1a3ef4ecd7968301cf2e2a90f01ce73a4de3ff002d267e
-
SSDEEP
1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrx:9bfVk29te2jqxCEtg30Bd
Score10/10-
Sakula payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-