sakula | NEAS[.]0e09b575fe45c8c91f65cd0625a67fd0_JC[.]exe

General

Target
NEAS.0e09b575fe45c8c91f65cd0625a67fd0_JC.exe
Size 98KB
Sample231024-ap8fmahd2t
SHA256 d9dbad10c866c206300b33084964c83ad8be741150f826903e16258f030d457e
MD5 0e09b575fe45c8c91f65cd0625a67fd0
SHA1 986bfd4b4f33f96ddddab052a29c14ab39b8dbdb
SHA512 02bca2042127a38ab8569f0f88645877a39f56a9771452712803c28400ccd2b3a179421735648407b38cf7ebc4ef5fe36d41ac4e414b56bbe70cde8133263631
SSDEEP 1536:XQFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX+ees52z30rtrBuxzuO:429DkEGRQixVSjLaes5G30B6l
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula

Malware Config

Extracted

Family

sakula

C2

www.polarroute.com

Signatures

Sakula family
sakula

Sakula payload 1 IoCs

resource	yara_rule
sample	family_sakula

File Explorer

NEAS.0e09b575fe45c8c91f65cd0625a67fd0_JC.exe

.exe 98KB

NEAS.0e09b575fe45c8c91f65cd0625a67fd0_JC.exe

IMPHASH 4511896d043677e4ab4578dc5bcab5a0
SHA256 d9dbad10c866c206300b33084964c83ad8be741150f826903e16258f030d457e
MD5 0e09b575fe45c8c91f65cd0625a67fd0
SHA1 986bfd4b4f33f96ddddab052a29c14ab39b8dbdb
SHA512 02bca2042127a38ab8569f0f88645877a39f56a9771452712803c28400ccd2b3a179421735648407b38cf7ebc4ef5fe36d41ac4e414b56bbe70cde8133263631
SSDEEP 1536:XQFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX+ees52z30rtrBuxzuO:429DkEGRQixVSjLaes5G30B6l
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Sakula payload

PE Signature issue

Digest

3b:cb:de:10:2b:72:e8:62:38:40:1e:5e:23:fa:b2:06:db:11:28:41:25:b6:b4:2c:e9:b7:01:ba:52:4d:7f:3a

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 18, 2023

Minor OS version

0

Major OS version

5

Entry point

18234

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentThread VirtualFree ExpandEnvironmentStringsA WriteFile OpenProcess WideCharToMultiByte GetVolumeInformationA Sleep SizeofResource CreateProcessA TerminateProcess ReadFile GetSystemDirectoryA MultiByteToWideChar GetTickCount CreateDirectoryA GetStartupInfoA FindFirstFileA GetLastError VirtualAlloc FindClose LockResource CreatePipe GetModuleFileNameA GetVersionExA WinExec CloseHandle GetCurrentProcessId GetTempPathA GetCurrentProcess LoadResource PeekNamedPipe SetFilePointer SetPriorityClass FindResourceA GetFileSize CreateFileA GetComputerNameA SetThreadPriority ExitProcess GetProcessHeap SetEndOfFile GetStringTypeW GetStringTypeA GetModuleHandleW GetProcAddress HeapFree HeapAlloc GetSystemTimeAsFileTime GetCommandLineA UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetStdHandle DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryA InitializeCriticalSectionAndSpinCount HeapCreate HeapReAlloc RtlUnwind GetConsoleCP GetConsoleMode SetHandleCount GetFileType FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers LCMapStringA LCMapStringW

advapi32

RegOpenKeyA GetUserNameA FreeSid AllocateAndInitializeSid RegDeleteKeyA EqualSid RegSetValueExA GetTokenInformation OpenProcessToken RegCloseKey

shell32

SHChangeNotify ord680 ShellExecuteA

wininet

HttpOpenRequestA InternetOpenUrlA HttpSendRequestA InternetOpenA InternetCloseHandle InternetConnectA InternetReadFile

Sharing