sakula | 18f4e140e1ec580fb96108e23d2f4d7359dd2942f84731850237a76d732ba0a3

General

Target
18f4e140e1ec580fb96108e23d2f4d7359dd2942f84731850237a76d732ba0a3
Size 89KB
Sample220212-dfxvbafbg2
SHA256 18f4e140e1ec580fb96108e23d2f4d7359dd2942f84731850237a76d732ba0a3
MD5 60b419cc2f0b4d5467429473cfae2f69
SHA1 38acdfdbc1c09915f452693e0a1a1c756694d4a1
SHA512 cfe9baa00cb44072bb8400d2eac67720dbeb3c2a80ce9bb870844b77bf16c877ef22cb7d0ec1019e24ebe91bb68ae1db9c4a72bb03f25f33defbe4f9eee0e7a3
SSDEEP 1536:KQFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX+ees52z30rtrk:B29DkEGRQixVSjLaes5G30B4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula

Malware Config

Signatures

Sakula Payload 1 IoCs

resource	yara_rule
sample	family_sakula

Sakula family
sakula

File Explorer

18f4e140e1ec580fb96108e23d2f4d7359dd2942f84731850237a76d732ba0a3

.exe 89KB

18f4e140e1ec580fb96108e23d2f4d7359dd2942f84731850237a76d732ba0a3

IMPHASH 4511896d043677e4ab4578dc5bcab5a0
SHA256 18f4e140e1ec580fb96108e23d2f4d7359dd2942f84731850237a76d732ba0a3
MD5 60b419cc2f0b4d5467429473cfae2f69
SHA1 38acdfdbc1c09915f452693e0a1a1c756694d4a1
SHA512 cfe9baa00cb44072bb8400d2eac67720dbeb3c2a80ce9bb870844b77bf16c877ef22cb7d0ec1019e24ebe91bb68ae1db9c4a72bb03f25f33defbe4f9eee0e7a3
SSDEEP 1536:KQFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX+ees52z30rtrk:B29DkEGRQixVSjLaes5G30B4
MD5 SHA1 SHA512 SSDEEP

windows x86

Sakula Payload

Minor OS version

Major OS version

Entry point

18234

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentThread VirtualFree ExpandEnvironmentStringsA WriteFile OpenProcess WideCharToMultiByte GetVolumeInformationA Sleep SizeofResource CreateProcessA TerminateProcess ReadFile GetSystemDirectoryA MultiByteToWideChar GetTickCount CreateDirectoryA GetStartupInfoA FindFirstFileA GetLastError VirtualAlloc FindClose LockResource CreatePipe GetModuleFileNameA GetVersionExA WinExec CloseHandle GetCurrentProcessId GetTempPathA GetCurrentProcess LoadResource PeekNamedPipe SetFilePointer SetPriorityClass FindResourceA GetFileSize CreateFileA GetComputerNameA SetThreadPriority ExitProcess GetProcessHeap SetEndOfFile GetStringTypeW GetStringTypeA GetModuleHandleW GetProcAddress HeapFree HeapAlloc GetSystemTimeAsFileTime GetCommandLineA UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetStdHandle DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryA InitializeCriticalSectionAndSpinCount HeapCreate HeapReAlloc RtlUnwind GetConsoleCP GetConsoleMode SetHandleCount GetFileType FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers LCMapStringA LCMapStringW

advapi32

RegOpenKeyA GetUserNameA FreeSid AllocateAndInitializeSid RegDeleteKeyA EqualSid RegSetValueExA GetTokenInformation OpenProcessToken RegCloseKey

shell32

SHChangeNotify ord680 ShellExecuteA

wininet

HttpOpenRequestA InternetOpenUrlA HttpSendRequestA InternetOpenA InternetCloseHandle InternetConnectA InternetReadFile

Sharing