Saba (now part of Cornerstone OnDemand) is a widely used talent management and learning platform. Large organizations like banks often mandate that employees complete training via such platforms.
The term "Repack" in this context signifies that the attackers took a legitimate installer and modified it.
Note: These are hypothetical examples typical of this campaign type. Specific hashes would be found in a live forensic analysis.