sakula | efb2aac42ae3c336beae35ea0063d1cec78261857a246693fd9d91a233b43636

Resubmissions

24/02/2022, 11:09

220224-m8635achc510

30/09/2021, 07:38

210930-jgeb9aghd58

Sharing

Copy URL Twitter E-mail

General

Target
efb2aac42ae3c336beae35ea0063d1cec78261857a246693fd9d91a233b43636
Size 3.9MB
Sample220224-m8635achc5
SHA256 efb2aac42ae3c336beae35ea0063d1cec78261857a246693fd9d91a233b43636
MD5 0c91f541c351849c1b48be81b7e4f197
SHA1 bda480d45467f44a36c6ac046a08b0b3b2e6bf83
SHA512 940176cdb87ada4590adb2ffa6fdb5694b950f7dc5f5a2b7f3d44b619de577efc46681e0b0e707137996b7aceec01e722804f2b2a046db3b7f45e7dda46e9b1c
SSDEEP 24576:j0Xx/6oTNa1h3Qh3O+ZrIb1Eu8CTPq30pYZMmjjTjuSE5DBMYr:j+5TY76HZ68kQ0paMmjjTjzeaYr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula

Malware Config

Signatures

Sakula Payload 1 IoCs

resource	yara_rule
sample	family_sakula

Sakula family
sakula

File Explorer

efb2aac42ae3c336beae35ea0063d1cec78261857a246693fd9d91a233b43636

.exe 3.9MB

efb2aac42ae3c336beae35ea0063d1cec78261857a246693fd9d91a233b43636

IMPHASH 539502771da573641ecc7f6497e39f8f
SHA256 efb2aac42ae3c336beae35ea0063d1cec78261857a246693fd9d91a233b43636
MD5 0c91f541c351849c1b48be81b7e4f197
SHA1 bda480d45467f44a36c6ac046a08b0b3b2e6bf83
SHA512 940176cdb87ada4590adb2ffa6fdb5694b950f7dc5f5a2b7f3d44b619de577efc46681e0b0e707137996b7aceec01e722804f2b2a046db3b7f45e7dda46e9b1c
SSDEEP 24576:j0Xx/6oTNa1h3Qh3O+ZrIb1Eu8CTPq30pYZMmjjTjuSE5DBMYr:j+5TY76HZ68kQ0paMmjjTjzeaYr
MD5 SHA1 SHA512 SSDEEP

windows x86

Sakula Payload

Minor OS version

Major OS version

Entry point

17029

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentThread VirtualFree ExpandEnvironmentStringsA WriteFile OpenProcess WideCharToMultiByte GetVolumeInformationA Sleep SizeofResource CreateProcessA ReadFile GetSystemDirectoryA MultiByteToWideChar SetThreadPriority GetTickCount GetStartupInfoA FindFirstFileA GetLastError VirtualAlloc FindClose LockResource CreatePipe GetModuleFileNameA GetVersionExA WinExec CloseHandle GetCurrentProcessId GetTempPathA GetCurrentProcess LoadResource PeekNamedPipe SetFilePointer SetPriorityClass FindResourceA GetFileSize CreateFileA GetComputerNameA CreateDirectoryA ExitProcess CreateFileW GetProcessHeap SetEndOfFile HeapReAlloc GetStringTypeW LCMapStringW FlushFileBuffers WriteConsoleW SetStdHandle GetProcAddress GetModuleHandleW DecodePointer HeapFree HeapAlloc GetSystemTimeAsFileTime GetCommandLineA HeapSetInformation GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetStdHandle GetModuleFileNameW HeapCreate RtlUnwind GetConsoleCP GetConsoleMode SetHandleCount GetFileType FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize IsProcessorFeaturePresent

advapi32

RegOpenKeyA GetUserNameA FreeSid AllocateAndInitializeSid RegDeleteKeyA EqualSid RegSetValueExA GetTokenInformation OpenProcessToken RegCloseKey

shell32

SHChangeNotify ord680 ShellExecuteA

wininet

HttpOpenRequestA InternetOpenUrlA HttpSendRequestA InternetOpenA InternetCloseHandle InternetConnectA InternetReadFile

Name

.text

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

YthjTtdK

Size

36KB

Virtual Size

35KB

Characteristics

Name

nZthxIkr

Size

104KB

Virtual Size

103KB

Characteristics

Name

TYERhsVL

Size

18KB

Virtual Size

18KB

Characteristics

Name

LTyKWdmL

Size

122KB

Virtual Size

121KB

Characteristics

Name

cXApKzpX

Size

166KB

Virtual Size

165KB

Characteristics

Name

OHXDivfp

Size

5KB

Virtual Size

4KB

Characteristics

Name

EADUrKCs

Size

73KB

Virtual Size

73KB

Characteristics

Name

WMzkEhJt

Size

38KB

Virtual Size

37KB

Characteristics

Name

FMeVVyMJ

Size

3KB

Virtual Size

2KB

Characteristics

Name

cDLjAPnl

Size

252KB

Virtual Size

252KB

Characteristics

Name

UAqkVkPt

Size

33KB

Virtual Size

32KB

Characteristics

Name

AAICZdzy

Size

5KB

Virtual Size

4KB

Characteristics

Name

IdHtIPFh

Size

82KB

Virtual Size

81KB

Characteristics

Name

rswxrnpN

Size

23KB

Virtual Size

23KB

Characteristics

Name

kKsQAkMH

Size

139KB

Virtual Size

139KB

Characteristics

Name

lYdLAJgH

Size

75KB

Virtual Size

74KB

Characteristics

Name

boLdeWKF

Size

512B

Virtual Size

110B

Characteristics

Name

vxvHJARj

Size

270KB

Virtual Size

270KB

Characteristics

Name

OKeqeIFb

Size

108KB

Virtual Size

107KB

Characteristics

Name

sWdCNdXo

Size

195KB

Virtual Size

194KB

Characteristics

Name

aOOumIfm

Size

44KB

Virtual Size

43KB

Characteristics

Name

ViSMaIKq

Size

124KB

Virtual Size

124KB

Characteristics

Name

wQKMzjRy

Size

21KB

Virtual Size

20KB

Characteristics

Name

KeERJrpF

Size

7KB

Virtual Size

6KB

Characteristics

Name

oJbZsuWv

Size

41KB

Virtual Size

40KB

Characteristics

Name

EeWNNVBr

Size

64KB

Virtual Size

64KB

Characteristics

Name

yCpVDjJP

Size

29KB

Virtual Size

28KB

Characteristics

Name

RBKWARaf

Size

15KB

Virtual Size

15KB

Characteristics

Name

wdRRxhZJ

Size

2KB

Virtual Size

2KB

Characteristics

Name

XOCDHLcp

Size

17KB

Virtual Size

17KB

Characteristics

Name

SSFqjgSJ

Size

39KB

Virtual Size

39KB

Characteristics

Name

EizEvGcw

Size

44KB

Virtual Size

44KB

Characteristics

Name

JdlTsRVw

Size

57KB

Virtual Size

56KB

Characteristics

Name

QrAFSlSk

Size

9KB

Virtual Size

9KB

Characteristics

Name

DrsmHyjm

Size

35KB

Virtual Size

34KB

Characteristics

Name

FMbNDdhh

Size

31KB

Virtual Size

30KB

Characteristics

Name

IhmPwwpL

Size

31KB

Virtual Size

31KB

Characteristics

Name

QCHuBcxm

Size

66KB

Virtual Size

66KB

Characteristics

Name

WhAczAlJ

Size

100KB

Virtual Size

100KB

Characteristics

Name

ZHaRwohD

Size

170KB

Virtual Size

170KB

Characteristics

Name

fWccgoMv

Size

85KB

Virtual Size

85KB

Characteristics

Name

ckHnXUHS

Size

78KB

Virtual Size

78KB

Characteristics

Name

LbZHwhqZ

Size

32KB

Virtual Size

31KB

Characteristics

Name

rwPJSCYH

Size

30KB

Virtual Size

30KB

Characteristics

Name

fDnwZvCk

Size

103KB

Virtual Size

102KB

Characteristics

Name

xquJTdei

Size

51KB

Virtual Size

50KB

Characteristics

Name

SGFRyOQs

Size

42KB

Virtual Size

41KB

Characteristics

Name

xlthyUeF

Size

44KB

Virtual Size

44KB

Characteristics

Name

cHZEsKrm

Size

47KB

Virtual Size

47KB

Characteristics

Name

bIlcqAsd

Size

4KB

Virtual Size

4KB

Characteristics

Name

vbknPSpF

Size

47KB

Virtual Size

47KB

Characteristics

Name

VWjgrFOL

Size

37KB

Virtual Size

37KB

Characteristics

Name

XAohaPuI

Size

6KB

Virtual Size

5KB

Characteristics

Name

clxNtTNS

Size

2KB

Virtual Size

2KB

Characteristics

Name

rMOCXTLm

Size

31KB

Virtual Size

31KB

Characteristics

Name

BSypJQwJ

Size

36KB

Virtual Size

35KB

Characteristics

Name

zmWALxuL

Size

54KB

Virtual Size

53KB

Characteristics

Name

ybTSPvph

Size

13KB

Virtual Size

13KB

Characteristics

Name

EnprsHUt

Size

4KB

Virtual Size

3KB

Characteristics

Name

HRFKniXC

Size

2KB

Virtual Size

2KB

Characteristics

Name

ZJUDkCPj

Size

73KB

Virtual Size

72KB

Characteristics

Name

SAIMbSjK

Size

512B

Virtual Size

135B

Characteristics

Name

BSZTKEZX

Size

10KB

Virtual Size

10KB

Characteristics

Name

KloVOCqn

Size

8KB

Virtual Size

7KB

Characteristics

Name

FFeqKPWg

Size

363KB

Virtual Size

362KB

Characteristics

Name

EkThKCAz

Size

16KB

Virtual Size

16KB

Characteristics

Name

RgNdonhV

Size

6KB

Virtual Size

6KB

Characteristics