sakula | 0c03fbac3fb8d2cf7d4cb471a2dce8cbce7a1a6574d563b46c9975c18ce89b94 | Triage

Sharing

General

Target

0c03fbac3fb8d2cf7d4cb471a2dce8cbce7a1a6574d563b46c9975c18ce89b94
Size

99KB
MD5

4b3c83649fd0cece7bf6c200e363b4d4
SHA1

a89e3aa73f1a54b166bf6f9635adc73ac2192235
SHA256

0c03fbac3fb8d2cf7d4cb471a2dce8cbce7a1a6574d563b46c9975c18ce89b94
SHA512

e159d09beafce0663015de20b79472b6251184c6ef9ff226f7bf13b1274db4e2b72c81e48b470ab7587e93a0f7dab30fb0bb07ec4e498457d50adef5c494ced6
SSDEEP

1536:Roaj1hJL1S9t0MIeboal8bCKxo7h0RPaaml0Nz30rtrhxo:i0hpgz6xGhZamyF30BVxo

Score

10^/10

sakula

Malware Config

Signatures

Sakula Payload 1 IoCs

Processes:

resource yara_rule

sample family_sakula
Sakula family
sakula

Files

0c03fbac3fb8d2cf7d4cb471a2dce8cbce7a1a6574d563b46c9975c18ce89b94
.exe windows x86

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.MPRESS1
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.imports
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE