sakula | 1350492f2d0d41a02ddeb543dff407b1ae22d80c1cbc5a8a05a3004da8234791 | Triage

Sharing

General

Target

1350492f2d0d41a02ddeb543dff407b1ae22d80c1cbc5a8a05a3004da8234791
Size

101KB
MD5

246f70908d9e8ce74ae73d018ba30d43
SHA1

f1016fd549f17d89af3c8bf088ceee34864e1a42
SHA256

1350492f2d0d41a02ddeb543dff407b1ae22d80c1cbc5a8a05a3004da8234791
SHA512

0331b0338dfcac541d6dbb1c3cfaefcda4076edf1351aefa8a9644f6ab09ed3aac49c3cac9adc260ae7d7a07f2461323358a4fdc3bb83473f7af13e51be6af28
SSDEEP

1536:Roaj1hJL1S9t0MIeboal8bCKxo7h0RPaaml0Nz30rtrPxQ:i0hpgz6xGhZamyF30B7xQ

Score

10^/10

sakula

Malware Config

Signatures

Sakula Payload 1 IoCs

Processes:

resource yara_rule

sample family_sakula
Sakula family
sakula

Files

1350492f2d0d41a02ddeb543dff407b1ae22d80c1cbc5a8a05a3004da8234791
.exe windows x86

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.MPRESS1
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.imports
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE