Static task
static1
Behavioral task
behavioral1
Sample
04b21e9e0dd60f18d7808e5cf691838a1844e78e96d3be2258fc0f062b0d5c61.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
04b21e9e0dd60f18d7808e5cf691838a1844e78e96d3be2258fc0f062b0d5c61.exe
Resource
win10v2004-en-20220112
General
-
Target
04b21e9e0dd60f18d7808e5cf691838a1844e78e96d3be2258fc0f062b0d5c61
-
Size
150KB
-
MD5
f1553d1817565b3416d08f9822e0258f
-
SHA1
58d95c22849b48b6ca3a65348a2fc2511d475278
-
SHA256
04b21e9e0dd60f18d7808e5cf691838a1844e78e96d3be2258fc0f062b0d5c61
-
SHA512
039f848dfeffb94f738fca291d468015f4ad640bdc640dec613692d920fa8a6096f5495500d3177d913a6201be90c6379db75e842e7e4595c39871e3045ed04f
-
SSDEEP
3072:H29DkEGRQixVSjLLJ30BWPOt5dQw+hyuGDInwr:H29qRfVSnt30Bbt+IhDFr
Malware Config
Signatures
-
Sakula Payload 1 IoCs
Processes:
resource yara_rule sample family_sakula -
Sakula family
Files
-
04b21e9e0dd60f18d7808e5cf691838a1844e78e96d3be2258fc0f062b0d5c61.exe windows x86
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.Upack Size: 107KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE