sakula | 148c5daeb5565d0b9aca8d53706b78a027242dab0b3f3ef35fb533f65fddc28a | Triage

Sharing

General

Target

148c5daeb5565d0b9aca8d53706b78a027242dab0b3f3ef35fb533f65fddc28a
Size

99KB
MD5

d7763de0e4870aa1374f4ae21216f0ad
SHA1

c27bd5092f81863588b240d5be9ea768c18d8b27
SHA256

148c5daeb5565d0b9aca8d53706b78a027242dab0b3f3ef35fb533f65fddc28a
SHA512

99cb587db7edbf28b0ab2a641df64961e84cdf8310a4f2ce0a5184af9c1d54942d252344671be55ef4f6ca86b72e6d8d66e5e967e8457fd83870b7c3954ec539
SSDEEP

1536:Roaj1hJL1S9t0MIeboal8bCKxo7h0RPSaml0Nz30rtr38J:i0hpgz6xGhpamyF30Bz8J

Score

10^/10

sakula

Malware Config

Signatures

Sakula Payload 1 IoCs

Processes:

resource yara_rule

sample family_sakula
Sakula family
sakula

Files

148c5daeb5565d0b9aca8d53706b78a027242dab0b3f3ef35fb533f65fddc28a
.exe windows x86

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.MPRESS1
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.imports
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE