sakula | 333e9cd3de0e15700879a56cab8582edc58415a6b6e1d99fbeb25a4eb2035634

General

Target
333e9cd3de0e15700879a56cab8582edc58415a6b6e1d99fbeb25a4eb2035634
Size 320KB
Sample220620-dqefqafag7
SHA256 333e9cd3de0e15700879a56cab8582edc58415a6b6e1d99fbeb25a4eb2035634
MD5 a5dd0f6c8c2ea5f149ed3acc9007ac90
SHA1 ed33315e87f92ac2bce194483c51caa877cb70d6
SHA512 cef10548622a0a47e88fce859e4cd55e01c59d8c3ac490fe8eb59980615ad994f308d15235bfdd8a64af146bef06325cf7bb0128bc7d736e6efa2bdd92fbd879
SSDEEP 1536:1oaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtroZeBsCXKTnhxJQ:W0hpgz6xGhTjwHN30BE8BsZhI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula

Malware Config

Signatures

Sakula Payload 1 IoCs

resource	yara_rule
sample	family_sakula

Sakula family
sakula

File Explorer

333e9cd3de0e15700879a56cab8582edc58415a6b6e1d99fbeb25a4eb2035634

.exe 320KB

333e9cd3de0e15700879a56cab8582edc58415a6b6e1d99fbeb25a4eb2035634

IMPHASH 539502771da573641ecc7f6497e39f8f
SHA256 333e9cd3de0e15700879a56cab8582edc58415a6b6e1d99fbeb25a4eb2035634
MD5 a5dd0f6c8c2ea5f149ed3acc9007ac90
SHA1 ed33315e87f92ac2bce194483c51caa877cb70d6
SHA512 cef10548622a0a47e88fce859e4cd55e01c59d8c3ac490fe8eb59980615ad994f308d15235bfdd8a64af146bef06325cf7bb0128bc7d736e6efa2bdd92fbd879
SSDEEP 1536:1oaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtroZeBsCXKTnhxJQ:W0hpgz6xGhTjwHN30BE8BsZhI
MD5 SHA1 SHA512 SSDEEP

windows x86

Sakula Payload

Minor OS version

Major OS version

Entry point

17029

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentThread VirtualFree ExpandEnvironmentStringsA WriteFile OpenProcess WideCharToMultiByte GetVolumeInformationA Sleep SizeofResource CreateProcessA ReadFile GetSystemDirectoryA MultiByteToWideChar SetThreadPriority GetTickCount GetStartupInfoA FindFirstFileA GetLastError VirtualAlloc FindClose LockResource CreatePipe GetModuleFileNameA GetVersionExA WinExec CloseHandle GetCurrentProcessId GetTempPathA GetCurrentProcess LoadResource PeekNamedPipe SetFilePointer SetPriorityClass FindResourceA GetFileSize CreateFileA GetComputerNameA CreateDirectoryA ExitProcess CreateFileW GetProcessHeap SetEndOfFile HeapReAlloc GetStringTypeW LCMapStringW FlushFileBuffers WriteConsoleW SetStdHandle GetProcAddress GetModuleHandleW DecodePointer HeapFree HeapAlloc GetSystemTimeAsFileTime GetCommandLineA HeapSetInformation GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetStdHandle GetModuleFileNameW HeapCreate RtlUnwind GetConsoleCP GetConsoleMode SetHandleCount GetFileType FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize IsProcessorFeaturePresent

advapi32

RegOpenKeyA GetUserNameA FreeSid AllocateAndInitializeSid RegDeleteKeyA EqualSid RegSetValueExA GetTokenInformation OpenProcessToken RegCloseKey

shell32

SHChangeNotify ord680 ShellExecuteA

wininet

HttpOpenRequestA InternetOpenUrlA HttpSendRequestA InternetOpenA InternetCloseHandle InternetConnectA InternetReadFile

Sharing