Static task
static1
Behavioral task
behavioral1
Sample
11345359b634c183e330196466dc70b8e0feaee70a419b1ea012707967b9e484.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
11345359b634c183e330196466dc70b8e0feaee70a419b1ea012707967b9e484.exe
Resource
win10v2004-en-20220113
General
-
Target
11345359b634c183e330196466dc70b8e0feaee70a419b1ea012707967b9e484
-
Size
150KB
-
MD5
b5d3c0728736eeb2227e4e92cf9f5d58
-
SHA1
99c367f1252bd0f1611a1a3c7c41c9164e820636
-
SHA256
11345359b634c183e330196466dc70b8e0feaee70a419b1ea012707967b9e484
-
SHA512
bbb4112e6f827abcc9bac7d5713176eef0773d34caee4fde1ebfb4ab3d43f1284fe7c387a3f3999e7555d9eb7dbf42aa3603d5c6c79a99764932d3e4e85154b1
-
SSDEEP
3072:H29DkEGRQixVSjLLJ30BWPOt5dQw+hyuGDInwh:H29qRfVSnt30Bbt+IhDFh
Malware Config
Signatures
-
Sakula Payload 1 IoCs
Processes:
resource yara_rule sample family_sakula -
Sakula family
Files
-
11345359b634c183e330196466dc70b8e0feaee70a419b1ea012707967b9e484.exe windows x86
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.Upack Size: 107KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE