sakula | 0cc0bc48fc0606a1b9ac574fc2797d7793565c5ebe4a9dff304b5b1388011247 | Triage

Sharing

General

Target

0cc0bc48fc0606a1b9ac574fc2797d7793565c5ebe4a9dff304b5b1388011247
Size

101KB
MD5

3cd70a92e68e822b0f97a38952f0e737
SHA1

ec54381764ed3e0d0cec868c1146dd30397c7a65
SHA256

0cc0bc48fc0606a1b9ac574fc2797d7793565c5ebe4a9dff304b5b1388011247
SHA512

8d1cc115b0f8d0dd0a57aa562416e75d052f7589400ec0b1073e1cfd39f3a5597b765d59611555c3594f2822d7ee17a3b25f088b0f9d735f59db14aa493ef38e
SSDEEP

1536:Roaj1hJL1S9t0MIeboal8bCKxo7h0RPaaml0Nz30rtr2xc:i0hpgz6xGhZamyF30BKxc

Score

10^/10

sakula

Malware Config

Signatures

Sakula Payload 1 IoCs

Processes:

resource yara_rule

sample family_sakula
Sakula family
sakula

Files

0cc0bc48fc0606a1b9ac574fc2797d7793565c5ebe4a9dff304b5b1388011247
.exe windows x86

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.MPRESS1
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.imports
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE