Static task
static1
Behavioral task
behavioral1
Sample
18853782a49e124910d860f0391baa7e1eff8970781f6ffaf6daa887f540b8a6.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
18853782a49e124910d860f0391baa7e1eff8970781f6ffaf6daa887f540b8a6.exe
Resource
win10v2004-en-20220112
General
-
Target
18853782a49e124910d860f0391baa7e1eff8970781f6ffaf6daa887f540b8a6
-
Size
150KB
-
MD5
585afb769d944c5d4876781d803ea8aa
-
SHA1
8011597c7983f954af5869c06e760d3e2cc603b1
-
SHA256
18853782a49e124910d860f0391baa7e1eff8970781f6ffaf6daa887f540b8a6
-
SHA512
dd1f8d951360fc6b0a15126bd77bf6c2882d7a3871364f46fd93154ae81a6e43e4dfa3832dcdfbd6e59117a80998badd7e302ed3c39482f3d843096072c581d5
-
SSDEEP
3072:H29DkEGRQixVSjLLJ30BWPOt5dQw+hyuGDInw0v:H29qRfVSnt30Bbt+IhDFg
Malware Config
Signatures
-
Sakula Payload 1 IoCs
Processes:
resource yara_rule sample family_sakula -
Sakula family
Files
-
18853782a49e124910d860f0391baa7e1eff8970781f6ffaf6daa887f540b8a6.exe windows x86
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.Upack Size: 107KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE