sakula | 127df2aa83727611766bf1fe7ae2eafcc469ff51cad9d01e45f35d020e678bf6 | Triage

Sharing

General

Target

127df2aa83727611766bf1fe7ae2eafcc469ff51cad9d01e45f35d020e678bf6
Size

99KB
MD5

5631d1cd3c92432bbb6701da341bdc64
SHA1

8ca1a0f65432a129f229ca1f75b4e8b0cf95b043
SHA256

127df2aa83727611766bf1fe7ae2eafcc469ff51cad9d01e45f35d020e678bf6
SHA512

8e8366a2423b7b8f027142df34bbc6b0444095d93164ef341960bc3d81d9b7f288a6db3190ba7891acb089ec2f1e27e0ad2015cd0b6452b976b4aa01e3986e38
SSDEEP

1536:Roaj1hJL1S9t0MIeboal8bCKxo7h0RPaaml0Nz30rtrbxD:i0hpgz6xGhZamyF30BXxD

Score

10^/10

sakula

Malware Config

Signatures

Sakula Payload 1 IoCs

Processes:

resource yara_rule

sample family_sakula
Sakula family
sakula

Files

127df2aa83727611766bf1fe7ae2eafcc469ff51cad9d01e45f35d020e678bf6
.exe windows x86

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.MPRESS1
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.imports
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE