sakula | d496522fd93ca1cb2bca9979b7868a39cbfb534ba328136a1d674dd8e88cd497

General

Target
d496522fd93ca1cb2bca9979b7868a39cbfb534ba328136a1d674dd8e88cd497
Size 222KB
Sample221017-kfz31abbc7
SHA256 d496522fd93ca1cb2bca9979b7868a39cbfb534ba328136a1d674dd8e88cd497
MD5 a999566216b6111e7e3a79cc38ea7275
SHA1 e7128d2bf65d01607ce1f636b99c8efeb08828f0
SHA512 445ca5235b0abe97b495cea68e5c5f805b096c8224a9622770ff5d289321a669a9ab90c90f22c56d9f145853eacac4be21d6391b46ee12ae061c8b639c877d2e
SSDEEP 6144:n29qRfVSnfj30BmhqC8WSr24AyqaLjLj64fm:zRfQniC8WSa4C6L2wm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula

Malware Config

Signatures

Sakula family
sakula

Sakula payload 1 IoCs

resource	yara_rule
sample	family_sakula

File Explorer

d496522fd93ca1cb2bca9979b7868a39cbfb534ba328136a1d674dd8e88cd497

.exe 222KB

d496522fd93ca1cb2bca9979b7868a39cbfb534ba328136a1d674dd8e88cd497

IMPHASH 4511896d043677e4ab4578dc5bcab5a0
SHA256 d496522fd93ca1cb2bca9979b7868a39cbfb534ba328136a1d674dd8e88cd497
MD5 a999566216b6111e7e3a79cc38ea7275
SHA1 e7128d2bf65d01607ce1f636b99c8efeb08828f0
SHA512 445ca5235b0abe97b495cea68e5c5f805b096c8224a9622770ff5d289321a669a9ab90c90f22c56d9f145853eacac4be21d6391b46ee12ae061c8b639c877d2e
SSDEEP 6144:n29qRfVSnfj30BmhqC8WSr24AyqaLjLj64fm:zRfQniC8WSa4C6L2wm
MD5 SHA1 SHA512 SSDEEP

windows x86

Sakula payload

PE Signature issue

Digest

7b:32:68:7f:c6:b6:e6:18:ad:31:7c:ab:18:fc:8b:6d:da:fb:23:41:c3:36:6f:53:66:6b:b3:c1:be:30:52:a9

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

18234

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentThread VirtualFree ExpandEnvironmentStringsA WriteFile OpenProcess WideCharToMultiByte GetVolumeInformationA Sleep SizeofResource CreateProcessA TerminateProcess ReadFile GetSystemDirectoryA MultiByteToWideChar GetTickCount CreateDirectoryA GetStartupInfoA FindFirstFileA GetLastError VirtualAlloc FindClose LockResource CreatePipe GetModuleFileNameA GetVersionExA WinExec CloseHandle GetCurrentProcessId GetTempPathA GetCurrentProcess LoadResource PeekNamedPipe SetFilePointer SetPriorityClass FindResourceA GetFileSize CreateFileA GetComputerNameA SetThreadPriority ExitProcess GetProcessHeap SetEndOfFile GetStringTypeW GetStringTypeA GetModuleHandleW GetProcAddress HeapFree HeapAlloc GetSystemTimeAsFileTime GetCommandLineA UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetStdHandle DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryA InitializeCriticalSectionAndSpinCount HeapCreate HeapReAlloc RtlUnwind GetConsoleCP GetConsoleMode SetHandleCount GetFileType FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers LCMapStringA LCMapStringW

advapi32

RegOpenKeyA GetUserNameA FreeSid AllocateAndInitializeSid RegDeleteKeyA EqualSid RegSetValueExA GetTokenInformation OpenProcessToken RegCloseKey

shell32

SHChangeNotify ord680 ShellExecuteA

wininet

HttpOpenRequestA InternetOpenUrlA HttpSendRequestA InternetOpenA InternetCloseHandle InternetConnectA InternetReadFile

Sharing