sakula | virussign[.]com_1bc0e4769e7c8d200892a2b1450961e0

General

Target
virussign.com_1bc0e4769e7c8d200892a2b1450961e0
Size 212KB
Sample220716-j4f5csbcam
SHA256 7a3c203d3668423e2bf6e11568ceeac3c5081d06f304db0db39fea341833323e
MD5 1bc0e4769e7c8d200892a2b1450961e0
SHA1 08b0805ed34458af16a73e494999ad2e8ba83655
SHA512 406170bf43063a2b18359560d73ef0c3bb0726d3f0d180d3aa02e504ac0cda3eb408606f8932ed35e4e0a84f1d04cbe0fa6212d910a33089dc496d8dd644a502
SSDEEP 1536:XcQFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX++pdz30rtr8gjXjp0danBt:r29DkEGRQixVSjLc130BYgjXjpDnBt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

upx sakula

Malware Config

Signatures

Sakula family
sakula

Sakula payload 1 IoCs

resource	yara_rule
sample	family_sakula

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

File Explorer

virussign.com_1bc0e4769e7c8d200892a2b1450961e0

.exe 212KB

virussign.com_1bc0e4769e7c8d200892a2b1450961e0

IMPHASH 4511896d043677e4ab4578dc5bcab5a0
SHA256 7a3c203d3668423e2bf6e11568ceeac3c5081d06f304db0db39fea341833323e
MD5 1bc0e4769e7c8d200892a2b1450961e0
SHA1 08b0805ed34458af16a73e494999ad2e8ba83655
SHA512 406170bf43063a2b18359560d73ef0c3bb0726d3f0d180d3aa02e504ac0cda3eb408606f8932ed35e4e0a84f1d04cbe0fa6212d910a33089dc496d8dd644a502
SSDEEP 1536:XcQFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX++pdz30rtr8gjXjp0danBt:r29DkEGRQixVSjLc130BYgjXjpDnBt
MD5 SHA1 SHA512 SSDEEP

windows x86

Sakula payload
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Minor OS version

Major OS version

Entry point

18234

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentThread VirtualFree ExpandEnvironmentStringsA WriteFile OpenProcess WideCharToMultiByte GetVolumeInformationA Sleep SizeofResource CreateProcessA TerminateProcess ReadFile GetSystemDirectoryA MultiByteToWideChar GetTickCount CreateDirectoryA GetStartupInfoA FindFirstFileA GetLastError VirtualAlloc FindClose LockResource CreatePipe GetModuleFileNameA GetVersionExA WinExec CloseHandle GetCurrentProcessId GetTempPathA GetCurrentProcess LoadResource PeekNamedPipe SetFilePointer SetPriorityClass FindResourceA GetFileSize CreateFileA GetComputerNameA SetThreadPriority ExitProcess GetProcessHeap SetEndOfFile GetStringTypeW GetStringTypeA GetModuleHandleW GetProcAddress HeapFree HeapAlloc GetSystemTimeAsFileTime GetCommandLineA UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetStdHandle DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryA InitializeCriticalSectionAndSpinCount HeapCreate HeapReAlloc RtlUnwind GetConsoleCP GetConsoleMode SetHandleCount GetFileType FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers LCMapStringA LCMapStringW

advapi32

RegOpenKeyA GetUserNameA FreeSid AllocateAndInitializeSid RegDeleteKeyA EqualSid RegSetValueExA GetTokenInformation OpenProcessToken RegCloseKey

shell32

SHChangeNotify ord680 ShellExecuteA

wininet

HttpOpenRequestA InternetOpenUrlA HttpSendRequestA InternetOpenA InternetCloseHandle InternetConnectA InternetReadFile

Sharing