Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    ebf23ac2a64b881d2b9d6b7a844476dd8f1907a2aa73f032aa9d6aa286227147

  • Size

    63KB

  • Sample

    240628-em99nashnq

  • MD5

    2a13ce031540a0eb6231dbc005827373

  • SHA1

    bb4a93a1c4f6f0f8d226d42d6fe57874b9d29d6b

  • SHA256

    ebf23ac2a64b881d2b9d6b7a844476dd8f1907a2aa73f032aa9d6aa286227147

  • SHA512

    4ff8a8d84985a028340b37d997bb176e6325c5b9395ffecd5472d546aea57bc5bd587d3741c20c43fc32fb9df154ac0769a54b2748517d1ab74faf1c2eb78db0

  • SSDEEP

    1536:zoxBP0D61Oj3+5FdOa52C8pdo95j6hZ2MzNDCkrl:0PPUj3+5FMIn8To94wa7l

Malware Config

Extracted

Family

sakula

C2

www.polarroute.com

Targets

    • Target

      ebf23ac2a64b881d2b9d6b7a844476dd8f1907a2aa73f032aa9d6aa286227147

    • Size

      63KB

    • MD5

      2a13ce031540a0eb6231dbc005827373

    • SHA1

      bb4a93a1c4f6f0f8d226d42d6fe57874b9d29d6b

    • SHA256

      ebf23ac2a64b881d2b9d6b7a844476dd8f1907a2aa73f032aa9d6aa286227147

    • SHA512

      4ff8a8d84985a028340b37d997bb176e6325c5b9395ffecd5472d546aea57bc5bd587d3741c20c43fc32fb9df154ac0769a54b2748517d1ab74faf1c2eb78db0

    • SSDEEP

      1536:zoxBP0D61Oj3+5FdOa52C8pdo95j6hZ2MzNDCkrl:0PPUj3+5FMIn8To94wa7l

    • Sakula

      Sakula is a remote access trojan with various capabilities.

    • Sakula payload

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks