sakula | 14acb4eb5b7f5c1d38e81846736ce34bda40ebfca708c731d16b7389afdf6715 | Triage

Sharing

General

Target

14acb4eb5b7f5c1d38e81846736ce34bda40ebfca708c731d16b7389afdf6715
Size

99KB
MD5

011875d3ad29c037fa7e3bb28025f500
SHA1

c293041014e54e3d7429164387d1d5c00fc47f5e
SHA256

14acb4eb5b7f5c1d38e81846736ce34bda40ebfca708c731d16b7389afdf6715
SHA512

704fa167b4d3ed29998fbf03f86604206502dcc39834fce3cf71da0b1c13a88f3671241e23689272ebb5e820bdccbbc63771901197c162d28f50a5d0b1a79b09
SSDEEP

1536:Roaj1hJL1S9t0MIeboal8bCKxo7h0RPSaml0Nz30rtr38M:i0hpgz6xGhpamyF30Bz8M

Score

10^/10

sakula

Malware Config

Signatures

Sakula Payload 1 IoCs

Processes:

resource yara_rule

sample family_sakula
Sakula family
sakula

Files

14acb4eb5b7f5c1d38e81846736ce34bda40ebfca708c731d16b7389afdf6715
.exe windows x86

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.MPRESS1
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.imports
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE