Static task
static1
Behavioral task
behavioral1
Sample
1514a81c2bfb48089b44c395addad629a73756ecc00fe01ae4af078d18044ff9.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
1514a81c2bfb48089b44c395addad629a73756ecc00fe01ae4af078d18044ff9.exe
Resource
win10v2004-en-20220112
General
-
Target
1514a81c2bfb48089b44c395addad629a73756ecc00fe01ae4af078d18044ff9
-
Size
150KB
-
MD5
00e9fcdb6930e32f956221b629c4a1ba
-
SHA1
31739624b0f87d4fca8d79a761cbb0d59d6370c2
-
SHA256
1514a81c2bfb48089b44c395addad629a73756ecc00fe01ae4af078d18044ff9
-
SHA512
0efab9d141ddeac5b9aa7a688c2580b6918a08d18e7cd8b3203a18ebb9e1d0bac7e530f4fc7a63195863cfbdc138c09e1e8f94ab2c6440dded57054b87e7834a
-
SSDEEP
3072:H29DkEGRQixVSjLLJ30BWPOt5dQw+hyuGDInwg:H29qRfVSnt30Bbt+IhDFg
Malware Config
Signatures
-
Sakula Payload 1 IoCs
Processes:
resource yara_rule sample family_sakula -
Sakula family
Files
-
1514a81c2bfb48089b44c395addad629a73756ecc00fe01ae4af078d18044ff9.exe windows x86
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.Upack Size: 107KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE