sakula | 145a9adc39268e8edf7723e9efaeef40975b4b583aa31f833700a094e6b7b715 | Triage

Sharing

General

Target

145a9adc39268e8edf7723e9efaeef40975b4b583aa31f833700a094e6b7b715
Size

99KB
MD5

bce00095a8858570af9799dda2429fef
SHA1

c4cb9a6fb8e18fddd33140f667293b46e349df93
SHA256

145a9adc39268e8edf7723e9efaeef40975b4b583aa31f833700a094e6b7b715
SHA512

c2703e7574df1344b79c9d766919fb93660b2bb466f7ff9dbf77c39644e8d44752b5a67babd70d9828ea165a6b4f89c9af9a91c7ed51aedc1f9279673d60ed84
SSDEEP

1536:Roaj1hJL1S9t0MIeboal8bCKxo7h0RPSaml0Nz30rtrd88:i0hpgz6xGhpamyF30B588

Score

10^/10

sakula

Malware Config

Signatures

Sakula Payload 1 IoCs

Processes:

resource yara_rule

sample family_sakula
Sakula family
sakula

Files

145a9adc39268e8edf7723e9efaeef40975b4b583aa31f833700a094e6b7b715
.exe windows x86

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.MPRESS1
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.imports
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE