sakula | 0c4ca495b0ce6af6fbfb88cd893ed1b84a42567b977bedde85946472df951977 | Triage

Sharing

General

Target

0c4ca495b0ce6af6fbfb88cd893ed1b84a42567b977bedde85946472df951977
Size

99KB
MD5

6e020077b34a76f472b3ba3f77c1209a
SHA1

02e4d17447d6ad2999958ebe99164b16d2317606
SHA256

0c4ca495b0ce6af6fbfb88cd893ed1b84a42567b977bedde85946472df951977
SHA512

e52167dc12f8d3cb040741c2472e74a6f1da79a0ad55fcbe2ebba8ff4b42e5d5bc622bcd0554b37057b9451e179acc6b4e1b184760b126e97e88b66416792b0f
SSDEEP

1536:Roaj1hJL1S9t0MIeboal8bCKxo7h0RPaaml0Nz30rtrhxW:i0hpgz6xGhZamyF30BVxW

Score

10^/10

sakula

Malware Config

Signatures

Sakula Payload 1 IoCs

Processes:

resource yara_rule

sample family_sakula
Sakula family
sakula

Files

0c4ca495b0ce6af6fbfb88cd893ed1b84a42567b977bedde85946472df951977
.exe windows x86

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.MPRESS1
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.imports
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE