sakula | 13ddcb0c0e6fa8c1295fed4da247adf989bddf660764452fc3d02347504bcf65 | Triage

Sharing

General

Target

13ddcb0c0e6fa8c1295fed4da247adf989bddf660764452fc3d02347504bcf65
Size

99KB
MD5

c75a4ef10b5ddee0be5114f65cb17ad7
SHA1

805463c17a9cb639f9f68ad0ea3acf1f7b02c037
SHA256

13ddcb0c0e6fa8c1295fed4da247adf989bddf660764452fc3d02347504bcf65
SHA512

f6732610bbf6bc5c227954db21d64e8c591413b448eebffc1fb52285915c1a5ab0fa1d333143d5feae4a1221221b0f6b0a49fc5ae8f6e8770ef981453d813f0a
SSDEEP

1536:Roaj1hJL1S9t0MIeboal8bCKxo7h0RPaaml0Nz30rtrexf:i0hpgz6xGhZamyF30B6xf

Score

10^/10

sakula

Malware Config

Signatures

Sakula Payload 1 IoCs

Processes:

resource yara_rule

sample family_sakula
Sakula family
sakula

Files

13ddcb0c0e6fa8c1295fed4da247adf989bddf660764452fc3d02347504bcf65
.exe windows x86

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.MPRESS1
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.imports
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE