sakula | 14541bc6ebc867669a8d89a2acd37f57ed932b484ebfa2400b853748da79090c | Triage

Sharing

General

Target

14541bc6ebc867669a8d89a2acd37f57ed932b484ebfa2400b853748da79090c
Size

101KB
MD5

e5c8f39466b7e7343bd17daf0a0baa29
SHA1

c40dd448870a1bcdf6ff1edaa5a0bb99768aed35
SHA256

14541bc6ebc867669a8d89a2acd37f57ed932b484ebfa2400b853748da79090c
SHA512

8eab8ea899ebe3edf5b5e2dbaf0924291fac056a5fc71bc79ef829f8a92263aacf174046d9de4371bcb7647c6897f5330bd1769b02dcc3605fb50cd1a47b0e25
SSDEEP

1536:Roaj1hJL1S9t0MIeboal8bCKxo7h0RPaaml0Nz30rtr2xQ:i0hpgz6xGhZamyF30BKxQ

Score

10^/10

sakula

Malware Config

Signatures

Sakula Payload 1 IoCs

Processes:

resource yara_rule

sample family_sakula
Sakula family
sakula

Files

14541bc6ebc867669a8d89a2acd37f57ed932b484ebfa2400b853748da79090c
.exe windows x86

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.MPRESS1
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.imports
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE