sakula | 15fa0c78717e021028a51e438eea42c788baa48bf28d5c65d5d1cda8e846a663 | Triage

Sharing

General

Target

15fa0c78717e021028a51e438eea42c788baa48bf28d5c65d5d1cda8e846a663
Size

99KB
MD5

e3f86fac24507d5749aa688fe0410fa6
SHA1

58529e7c828cc78cea4be5428e426bb87990c3af
SHA256

15fa0c78717e021028a51e438eea42c788baa48bf28d5c65d5d1cda8e846a663
SHA512

3f1cd778b0dcaddba0eb035f7f25bca296c83f585aefbec28874937ed352d3583fc2d6ce3238640ee36b33c1343e11f6043c25a4d69a1fab642a4d7d68cdd162
SSDEEP

1536:Roaj1hJL1S9t0MIeboal8bCKxo7h0RPaaml0Nz30rtrhxo:i0hpgz6xGhZamyF30BVxo

Score

10^/10

sakula

Malware Config

Signatures

Sakula Payload 1 IoCs

Processes:

resource yara_rule

sample family_sakula
Sakula family
sakula

Files

15fa0c78717e021028a51e438eea42c788baa48bf28d5c65d5d1cda8e846a663
.exe windows x86

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.MPRESS1
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.imports
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE