General

  • Target

    43e14d8797b364f39c76b44f2ecdba86fcaef269230720d2a98ce29574c18d12N.exe

  • Size

    89KB

  • Sample

    250117-shbgestlgn

  • MD5

    91b0c4eb5e7e1a582b0d172e45a8df40

  • SHA1

    318bbce6ab8ace0aa75a9143386fe25525a9ce96

  • SHA256

    43e14d8797b364f39c76b44f2ecdba86fcaef269230720d2a98ce29574c18d12

  • SHA512

    3ce6eb7c759f64f30c1d3477bb5cbb588d4af3ec1ade7ad67195a43a858eb26fea7ed18e6756cdb7bbe872f30c8c0de02425dcea2d39986aeb13c8ed6fb120b2

  • SSDEEP

    1536:xQFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX+fes5Lz30rtrw:q29DkEGRQixVSjLTes5330BM

Malware Config

Extracted

Family

sakula

C2

www.polarroute.com

Targets

    • Target

      43e14d8797b364f39c76b44f2ecdba86fcaef269230720d2a98ce29574c18d12N.exe

    • Size

      89KB

    • MD5

      91b0c4eb5e7e1a582b0d172e45a8df40

    • SHA1

      318bbce6ab8ace0aa75a9143386fe25525a9ce96

    • SHA256

      43e14d8797b364f39c76b44f2ecdba86fcaef269230720d2a98ce29574c18d12

    • SHA512

      3ce6eb7c759f64f30c1d3477bb5cbb588d4af3ec1ade7ad67195a43a858eb26fea7ed18e6756cdb7bbe872f30c8c0de02425dcea2d39986aeb13c8ed6fb120b2

    • SSDEEP

      1536:xQFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX+fes5Lz30rtrw:q29DkEGRQixVSjLTes5330BM

    • Sakula

      Sakula is a remote access trojan with various capabilities.

    • Sakula family

    • Sakula payload

MITRE ATT&CK Enterprise v15

Tasks