sakula | 0de3dc731f0ba5373ee22df36ca1721ea3bcfc4808e185c9f8cd24dfdca72dbf | Triage

Sharing

General

Target

0de3dc731f0ba5373ee22df36ca1721ea3bcfc4808e185c9f8cd24dfdca72dbf
Size

99KB
MD5

6a6f502ce1bf1ed046e3881d0333ad0d
SHA1

47f5b8108acefbe7ad972fbe5365818b097daaaa
SHA256

0de3dc731f0ba5373ee22df36ca1721ea3bcfc4808e185c9f8cd24dfdca72dbf
SHA512

577c09a82bb52c0a068781fe4e3f84f6c1153baa69b0b31f7cb8052aeb7fefcd7e9e489b450dfb9311d6ad24a6bb9faaed75ebccfbf205761f7c203a08e3d16d
SSDEEP

1536:Roaj1hJL1S9t0MIeboal8bCKxo7h0RPSaml0Nz30rtrd8w:i0hpgz6xGhpamyF30B58w

Score

10^/10

sakula

Malware Config

Signatures

Sakula Payload 1 IoCs

Processes:

resource yara_rule

sample family_sakula
Sakula family
sakula

Files

0de3dc731f0ba5373ee22df36ca1721ea3bcfc4808e185c9f8cd24dfdca72dbf
.exe windows x86

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.MPRESS1
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.imports
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE