Static task
static1
Behavioral task
behavioral1
Sample
4886158339549161bbdd686380eca837e3ec42609b43d70c435a3dd4dd891fc1.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4886158339549161bbdd686380eca837e3ec42609b43d70c435a3dd4dd891fc1.exe
Resource
win10v2004-20220414-en
General
-
Target
4886158339549161bbdd686380eca837e3ec42609b43d70c435a3dd4dd891fc1
-
Size
4.0MB
-
MD5
8d6f5b2d3d762e2d01f1583368bb307c
-
SHA1
4d157affd8c375e2a0b5f888bcf68df4e670ea39
-
SHA256
4886158339549161bbdd686380eca837e3ec42609b43d70c435a3dd4dd891fc1
-
SHA512
cfe691a8f59fef0bfa1e39bc45a3847afcf7e37e35a73b03a9192a260baeba461e2dc12c5d8cb3524db4f44c0fb45c815f90cd23f2b0bd79d76b259717a84ff9
-
SSDEEP
24576:DF9mrnE2Z1y/6oTNBZrBEu8C7jnIQCwRO/wTGS5DBMYp:DD2Z1qT3Zz888QCwRO/wT/aYp
Malware Config
Signatures
-
Sakula family
-
Sakula payload 1 IoCs
Processes:
resource yara_rule sample family_sakula
Files
-
4886158339549161bbdd686380eca837e3ec42609b43d70c435a3dd4dd891fc1.exe windows x86
539502771da573641ecc7f6497e39f8f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentThread
VirtualFree
ExpandEnvironmentStringsA
WriteFile
OpenProcess
WideCharToMultiByte
GetVolumeInformationA
Sleep
SizeofResource
CreateProcessA
ReadFile
GetSystemDirectoryA
MultiByteToWideChar
SetThreadPriority
GetTickCount
GetStartupInfoA
FindFirstFileA
GetLastError
VirtualAlloc
FindClose
LockResource
CreatePipe
GetModuleFileNameA
GetVersionExA
WinExec
CloseHandle
GetCurrentProcessId
GetTempPathA
GetCurrentProcess
LoadResource
PeekNamedPipe
SetFilePointer
SetPriorityClass
FindResourceA
GetFileSize
CreateFileA
GetComputerNameA
CreateDirectoryA
ExitProcess
CreateFileW
GetProcessHeap
SetEndOfFile
HeapReAlloc
GetStringTypeW
LCMapStringW
FlushFileBuffers
WriteConsoleW
SetStdHandle
GetProcAddress
GetModuleHandleW
DecodePointer
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetStdHandle
GetModuleFileNameW
HeapCreate
RtlUnwind
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
IsProcessorFeaturePresent
advapi32
RegOpenKeyA
GetUserNameA
FreeSid
AllocateAndInitializeSid
RegDeleteKeyA
EqualSid
RegSetValueExA
GetTokenInformation
OpenProcessToken
RegCloseKey
shell32
SHChangeNotify
ord680
ShellExecuteA
wininet
HttpOpenRequestA
InternetOpenUrlA
HttpSendRequestA
InternetOpenA
InternetCloseHandle
InternetConnectA
InternetReadFile
Sections
.text Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ZPAFZkHb Size: 25KB - Virtual size: 25KB
FgOtCMnJ Size: 118KB - Virtual size: 117KB
qifHzdfC Size: 23KB - Virtual size: 22KB
PmLTNNwN Size: 449KB - Virtual size: 449KB
CAeRsksy Size: 131KB - Virtual size: 131KB
WNqgksdF Size: 306KB - Virtual size: 306KB
zAPRRXXX Size: 37KB - Virtual size: 36KB
BtRJRpXY Size: 1024B - Virtual size: 802B
nZodfacz Size: 39KB - Virtual size: 39KB
MyTvqJIO Size: 292KB - Virtual size: 292KB
fhPRWJFV Size: 42KB - Virtual size: 42KB
zMJCkwcK Size: 6KB - Virtual size: 5KB
yCQRfCkV Size: 27KB - Virtual size: 27KB
TdPTxZqh Size: 57KB - Virtual size: 57KB
ASeJycBq Size: 7KB - Virtual size: 6KB
lSLAzqpH Size: 16KB - Virtual size: 15KB
NxgbgIeO Size: 512B - Virtual size: 416B
hymexttH Size: 213KB - Virtual size: 212KB
InAHxrlU Size: 78KB - Virtual size: 77KB
iTunkIJj Size: 178KB - Virtual size: 177KB
alQxpkWX Size: 20KB - Virtual size: 19KB
UEWyXZeV Size: 15KB - Virtual size: 14KB
AFQLMBti Size: 10KB - Virtual size: 9KB
NHNyXfRe Size: 31KB - Virtual size: 31KB
lXvRqYZy Size: 27KB - Virtual size: 27KB
PXNqkCiG Size: 19KB - Virtual size: 18KB
tVDBjIej Size: 16KB - Virtual size: 15KB
edGJjudG Size: 67KB - Virtual size: 66KB
HIRFPMoZ Size: 512B - Virtual size: 409B
VMpKpHwI Size: 38KB - Virtual size: 37KB
KzLElcrT Size: 31KB - Virtual size: 31KB
gQsogKnr Size: 76KB - Virtual size: 75KB
BIKDPCGr Size: 40KB - Virtual size: 39KB
NxLKMJnM Size: 8KB - Virtual size: 8KB
UCYVIBKx Size: 23KB - Virtual size: 22KB
KApSmErd Size: 27KB - Virtual size: 27KB
wMLiVkON Size: 14KB - Virtual size: 14KB
vhOQcfXX Size: 41KB - Virtual size: 40KB
ipaqzEpq Size: 44KB - Virtual size: 43KB
EvjarYER Size: 26KB - Virtual size: 26KB
lXmapncp Size: 44KB - Virtual size: 43KB
yIsJYAkW Size: 18KB - Virtual size: 17KB
SyLnYtqT Size: 30KB - Virtual size: 29KB
yxAWFzwo Size: 61KB - Virtual size: 61KB
EYIMnDPm Size: 36KB - Virtual size: 35KB
oEvVCkAF Size: 70KB - Virtual size: 70KB
UPUOufax Size: 24KB - Virtual size: 23KB
nLkQbmWq Size: 31KB - Virtual size: 30KB
LWYdwfOz Size: 298KB - Virtual size: 298KB
AQKrgCUY Size: 5KB - Virtual size: 4KB
GgvNSYhW Size: 2KB - Virtual size: 2KB
ONmmTCGG Size: 1024B - Virtual size: 747B
fgWNTWCw Size: 512B - Virtual size: 85B
LkGLaebU Size: 13KB - Virtual size: 13KB
GdoAtjCv Size: 6KB - Virtual size: 5KB
OwmEiuZH Size: 14KB - Virtual size: 13KB
IjBeGXEt Size: 7KB - Virtual size: 6KB
aDEwMCpw Size: 4KB - Virtual size: 4KB
dXkMVcvf Size: 22KB - Virtual size: 21KB
KQhVAKOK Size: 5KB - Virtual size: 4KB
PJbJuDKc Size: 38KB - Virtual size: 38KB
WjhoKUTs Size: 512B - Virtual size: 459B
HOHEwBTi Size: 32KB - Virtual size: 32KB
oQwqYdOF Size: 19KB - Virtual size: 18KB
RNncMaSg Size: 258KB - Virtual size: 258KB
FsjTZJCn Size: 24KB - Virtual size: 24KB
oIRklPgB Size: 2KB - Virtual size: 1KB