General
-
Target
c221c0b7c68a8c652a57fa433f0f21a5f9d94b13aedbcc9053eb28a41268e745
-
Size
376KB
-
Sample
240619-dec4hsseme
-
MD5
5a2adaed47828b90e6a01ee6cbff4729
-
SHA1
d7fff8c492c9c1c692f3ee98c9712ee3fbb9155f
-
SHA256
c221c0b7c68a8c652a57fa433f0f21a5f9d94b13aedbcc9053eb28a41268e745
-
SHA512
dcfdefd2e88487956fb4d0d8a1857f56c3e0ed0389b21d459f9a5931de2a5e5644c8a6f90f787a3c603599d686996f4ccf74d344a6ba15a38fbe16a3e3455c93
-
SSDEEP
6144:M29qRfVSndj30B3wBxE1+ijiBKk3etdgI2MyzNORQtOfl1qNVo7R+S+N/TU7kn5Y:0RfQn+w8EYiBlMkn5Y
Behavioral task
behavioral1
Sample
c221c0b7c68a8c652a57fa433f0f21a5f9d94b13aedbcc9053eb28a41268e745.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
c221c0b7c68a8c652a57fa433f0f21a5f9d94b13aedbcc9053eb28a41268e745.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
sakula
www.polarroute.com
Targets
-
-
Target
c221c0b7c68a8c652a57fa433f0f21a5f9d94b13aedbcc9053eb28a41268e745
-
Size
376KB
-
MD5
5a2adaed47828b90e6a01ee6cbff4729
-
SHA1
d7fff8c492c9c1c692f3ee98c9712ee3fbb9155f
-
SHA256
c221c0b7c68a8c652a57fa433f0f21a5f9d94b13aedbcc9053eb28a41268e745
-
SHA512
dcfdefd2e88487956fb4d0d8a1857f56c3e0ed0389b21d459f9a5931de2a5e5644c8a6f90f787a3c603599d686996f4ccf74d344a6ba15a38fbe16a3e3455c93
-
SSDEEP
6144:M29qRfVSndj30B3wBxE1+ijiBKk3etdgI2MyzNORQtOfl1qNVo7R+S+N/TU7kn5Y:0RfQn+w8EYiBlMkn5Y
Score10/10-
Sakula payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-