sakula | 1777b49b3328a4b8616a9d2cdf13da5ac452640aaada5be94bede18dfbca9381 | Triage

Sharing

General

Target

1777b49b3328a4b8616a9d2cdf13da5ac452640aaada5be94bede18dfbca9381
Size

99KB
MD5

d8951c20e180ff002b92029ecb5296d8
SHA1

d43dc2242fd01d0fb2705af8426debe67370a5f8
SHA256

1777b49b3328a4b8616a9d2cdf13da5ac452640aaada5be94bede18dfbca9381
SHA512

e543f5b078dd5276e852eb2fa136c9371c9fc2dd671e82da48de73bd16e4a24fb69d93d0a8695c7798a14cd333435f3e10e9939e0d56e2bdeda15bea74325237
SSDEEP

1536:Zoaj1hJL1S9t0MIeboal8bCKxo7h0RPaaml0Nz30rtrdxY:K0hpgz6xGhZamyF30BhxY

Score

10^/10

sakula

Malware Config

Signatures

Sakula Payload 1 IoCs

Processes:

resource yara_rule

sample family_sakula
Sakula family
sakula

Files

1777b49b3328a4b8616a9d2cdf13da5ac452640aaada5be94bede18dfbca9381
.exe windows x86

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.MPRESS1
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.imports
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE