sakula | 0d89dffbb8c50b0e1ba5adcb22f6f3ed5c488ee808636b4258fec107e86ba842 | Triage

Sharing

General

Target

0d89dffbb8c50b0e1ba5adcb22f6f3ed5c488ee808636b4258fec107e86ba842
Size

101KB
MD5

68c5c401528ecb532b9927c66642b23b
SHA1

bff18fb138d0f2dbf946280d41a2906d0ab8abd2
SHA256

0d89dffbb8c50b0e1ba5adcb22f6f3ed5c488ee808636b4258fec107e86ba842
SHA512

9d110ff5be4f24ef57c13020597f323c27f7245f263490435047035a2131549c64b45b45a51247369988d265125e995f240b7c8dd4be3568ab0e2a8251148042
SSDEEP

1536:Roaj1hJL1S9t0MIeboal8bCKxo7h0RPaaml0Nz30rtrhxw:i0hpgz6xGhZamyF30Bdxw

Score

10^/10

sakula

Malware Config

Signatures

Sakula Payload 1 IoCs

Processes:

resource yara_rule

sample family_sakula
Sakula family
sakula

Files

0d89dffbb8c50b0e1ba5adcb22f6f3ed5c488ee808636b4258fec107e86ba842
.exe windows x86

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.MPRESS1
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.imports
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE