sakula | 84332eb92ad2cde1781383cc6b3923cf31027be28594be5567135e117b64be93

Sharing

Copy URL

Twitter E-mail

General

Target

84332eb92ad2cde1781383cc6b3923cf31027be28594be5567135e117b64be93
Size

67KB
MD5

b5dcd230c70b652c7af3e636aea6bbb8
SHA1

5e9a782544550e26ec37155df9852d143efeb59b
SHA256

84332eb92ad2cde1781383cc6b3923cf31027be28594be5567135e117b64be93
SHA512

54e687004c42cbc52e1aa7c6f9040dfdd85c8208cef1f1218b36a1edff94edbc152400750c60456c3b20902641945de48fe742f3ee8ae9385b91554931dc5f7d
SSDEEP

1536:BH13yXXuZJ4nl3lsTsHjzQoaPgtPly29aKUk:n3yOzAYocmYKUk

Score

10^/10

sakula

Malware Config

Signatures

Sakula Payload 1 IoCs

Processes:

resource yara_rule

sample family_sakula
Sakula family
sakula

resource	yara_rule
sample	family_sakula

Files

84332eb92ad2cde1781383cc6b3923cf31027be28594be5567135e117b64be93
.dll windows x86

ba0e0d6523bb8b91eca23a3919c423c0

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
WriteFile
OpenProcess
WideCharToMultiByte
GetVolumeInformationA
Sleep
CreateProcessA
TerminateProcess
ReadFile
GetSystemDirectoryA
MultiByteToWideChar
GetStartupInfoA
GetTickCount
GetLastError
VirtualAlloc
FindClose
CreatePipe
GetModuleFileNameA
GetVersionExA
WinExec
CloseHandle
GetCurrentProcessId
GetTempPathA
CreateThread
PeekNamedPipe
SetFilePointer
GetFileSize
CreateFileA
GetComputerNameA
FindFirstFileA
ExitProcess
CreateFileW
GetProcessHeap
SetEndOfFile
HeapSize
GetStringTypeW
LCMapStringW
WriteConsoleW
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCurrentThreadId
DecodePointer
GetCommandLineA
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
HeapCreate
HeapDestroy
GetProcAddress
GetModuleHandleW
GetStdHandle
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetHandleCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
IsProcessorFeaturePresent
LoadLibraryW
SetStdHandle
FlushFileBuffers
HeapReAlloc

advapi32

FreeSid
AllocateAndInitializeSid
EqualSid
GetTokenInformation
OpenProcessToken
GetUserNameA

shell32

ord680

wininet

HttpOpenRequestA
InternetOpenA
InternetConnectA
InternetOpenUrlA
InternetCloseHandle
InternetReadFile
HttpSendRequestA

Sections

.text
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ba0e0d6523bb8b91eca23a3919c423c0

Code Sign

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

wininet

Sections

.text Size: 45KB - Virtual size: 45KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 6KB - Virtual size: 14KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 45KB - Virtual size: 45KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 6KB - Virtual size: 14KB

.reloc
Size: 4KB - Virtual size: 3KB