Static task
static1
Behavioral task
behavioral1
Sample
0618792d79479870f9c77dbdead8d0786ffc7f843c97c96b4a8d533a0e7f6b71.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
0618792d79479870f9c77dbdead8d0786ffc7f843c97c96b4a8d533a0e7f6b71.exe
Resource
win10v2004-en-20220113
General
-
Target
0618792d79479870f9c77dbdead8d0786ffc7f843c97c96b4a8d533a0e7f6b71
-
Size
100KB
-
MD5
66fc377c0712e10a330bc4eb2433f6f6
-
SHA1
776d011a4aab99c073e2c3eff1988090e7ea3112
-
SHA256
0618792d79479870f9c77dbdead8d0786ffc7f843c97c96b4a8d533a0e7f6b71
-
SHA512
12a5c9ad95e2b5a656998a1382dea2417a5221105a2572cd51b5e5691385d511648eb979e9bbde4a1024673dd274c076c403b8c972af188f7c03c0c86138ba71
-
SSDEEP
1536:Zoaj1hJL1S9t0MIeboal8bCKxo7h0RPaaml0Nz30rtrJxZ:K0hpgz6xGhZamyF30BNxZ
Malware Config
Signatures
-
Sakula Payload 1 IoCs
Processes:
resource yara_rule sample family_sakula -
Sakula family
Files
-
0618792d79479870f9c77dbdead8d0786ffc7f843c97c96b4a8d533a0e7f6b71.exe windows x86
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE