Details
Malware Family Sakula
Date Added April 24, 2016, 6:49 a.m.
MD5 d7ae60d2e59ee578afb83528f7967d2e
Sha256 0bfad6faa6f36f0b0e58bff07de188761be15b5a3e53c6d9e40f8ded81feb00e
Robot Robots lovingly delivered by robohash.org
Config Sections
2_Copy File Name MediaCenter.exe
2_URI GET2 File /viewphoto.asp
1_Copy File Name MediaCenter.exe
1_Waiting Time 30000
1_URI GET3 File newimage.asp
2_URI GET1 Folder /photo/
1_URI GET1 Folder /photo/
2_Campaign ID honeywell
2_Domain www.northpoleroute.com
2_URI GET3 Arg imageid
2_Copy File Path %Temp%\MicroMedia
1_Copy File Path %Temp%\MicroMedia
1_AutoRun Key MicroMedia
2_URI GET3 File newimage.asp
2_AutoRun Key MicroMedia
2_Waiting Time 30000
1_Domain www.polarroute.com
1_URI GET2 File /viewphoto.asp
1_URI GET3 Arg imageid
1_Campaign ID honeywell
Advertising
VirusTotal

50 out of 57 AV's Identified the sample as Malicious

Virus Total Report

Domain Data
Domain IP Country Code
www.polarroute.com 0
www.northpoleroute.com 0
Geo Location
Yara Rules
Comments
comments powered by Disqus