sakula | 6d8032357e664749d95c74c3cc618231

Sharing

Copy URL Twitter E-mail

General

Target
6d8032357e664749d95c74c3cc618231
Size 3.6MB
Sample231219-wbfpcafggn
SHA256 2cca320792270200228141c046006de65a23d2d75ae736216d27d7b1f6161b6a
MD5 6d8032357e664749d95c74c3cc618231
SHA1 ea0f06dc70bd88554e2231d8a9e8545e40dc4df1
SHA512 4eed9e97c4e9e5cca3c71fce9bbb0880e9c9fa36b8db9e55f95bdab7a536b8e410bd223e5723d5ae54e6850ec896fcd1977911f7edf74c6288d3a0f01d45abac
SSDEEP 49152:o852ZjeUNZZH46HsnHVT5ZA+acdD6xXTIN:oU6eUNZZJHsHr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula

Malware Config

Extracted

Family

sakula

www.polarroute.com

Signatures

Sakula family
sakula

Sakula payload 1 IoCs

resource	yara_rule
sample	family_sakula

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6d8032357e664749d95c74c3cc618231

File Explorer

6d8032357e664749d95c74c3cc618231

.exe 3.6MB

6d8032357e664749d95c74c3cc618231

IMPHASH 4511896d043677e4ab4578dc5bcab5a0
SHA256 2cca320792270200228141c046006de65a23d2d75ae736216d27d7b1f6161b6a
MD5 6d8032357e664749d95c74c3cc618231
SHA1 ea0f06dc70bd88554e2231d8a9e8545e40dc4df1
SHA512 4eed9e97c4e9e5cca3c71fce9bbb0880e9c9fa36b8db9e55f95bdab7a536b8e410bd223e5723d5ae54e6850ec896fcd1977911f7edf74c6288d3a0f01d45abac
SSDEEP 49152:o852ZjeUNZZH46HsnHVT5ZA+acdD6xXTIN:oU6eUNZZJHsHr
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Sakula payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18234

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentThread VirtualFree ExpandEnvironmentStringsA WriteFile OpenProcess WideCharToMultiByte GetVolumeInformationA Sleep SizeofResource CreateProcessA TerminateProcess ReadFile GetSystemDirectoryA MultiByteToWideChar GetTickCount CreateDirectoryA GetStartupInfoA FindFirstFileA GetLastError VirtualAlloc FindClose LockResource CreatePipe GetModuleFileNameA GetVersionExA WinExec CloseHandle GetCurrentProcessId GetTempPathA GetCurrentProcess LoadResource PeekNamedPipe SetFilePointer SetPriorityClass FindResourceA GetFileSize CreateFileA GetComputerNameA SetThreadPriority ExitProcess GetProcessHeap SetEndOfFile GetStringTypeW GetStringTypeA GetModuleHandleW GetProcAddress HeapFree HeapAlloc GetSystemTimeAsFileTime GetCommandLineA UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetStdHandle DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryA InitializeCriticalSectionAndSpinCount HeapCreate HeapReAlloc RtlUnwind GetConsoleCP GetConsoleMode SetHandleCount GetFileType FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers LCMapStringA LCMapStringW

advapi32

RegOpenKeyA GetUserNameA FreeSid AllocateAndInitializeSid RegDeleteKeyA EqualSid RegSetValueExA GetTokenInformation OpenProcessToken RegCloseKey

shell32

SHChangeNotify ord680 ShellExecuteA

wininet

HttpOpenRequestA InternetOpenUrlA HttpSendRequestA InternetOpenA InternetCloseHandle InternetConnectA InternetReadFile

Name

.text

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

rqqSnjff

Size

28KB

Virtual Size

27KB

Characteristics

Name

ZuYDnQus

Size

63KB

Virtual Size

63KB

Characteristics

Name

abHfUQdm

Size

11KB

Virtual Size

11KB

Characteristics

Name

aFYOmKuK

Size

916KB

Virtual Size

916KB

Characteristics

Name

WMfUQWYO

Size

15KB

Virtual Size

15KB

Characteristics

Name

LxpHtypF

Size

54KB

Virtual Size

53KB

Characteristics

Name

LdmyUECW

Size

10KB

Virtual Size

9KB

Characteristics

Name

kdaerigj

Size

5KB

Virtual Size

5KB

Characteristics

Name

xTRBCPWY

Size

512B

Virtual Size

91B

Characteristics

Name

fftIrTla

Size

305KB

Virtual Size

305KB

Characteristics

Name

NizCKrUC

Size

11KB

Virtual Size

10KB

Characteristics

Name

IprxNhVf

Size

6KB

Virtual Size

6KB

Characteristics

Name

JKZYzPll

Size

12KB

Virtual Size

12KB

Characteristics

Name

HIXqrxkJ

Size

23KB

Virtual Size

22KB

Characteristics

Name

RDtOwzVL

Size

3KB

Virtual Size

2KB

Characteristics

Name

YDsjwdEx

Size

63KB

Virtual Size

63KB

Characteristics

Name

hQZOjuog

Size

512B

Virtual Size

133B

Characteristics

Name

OtXJFDvu

Size

38KB

Virtual Size

38KB

Characteristics

Name

FznUrUCN

Size

135KB

Virtual Size

134KB

Characteristics

Name

JfFuCXrf

Size

29KB

Virtual Size

29KB

Characteristics

Name

HGcIWQRy

Size

30KB

Virtual Size

30KB

Characteristics

Name

AJmsKGbw

Size

35KB

Virtual Size

35KB

Characteristics

Name

EFzaxNcL

Size

61KB

Virtual Size

60KB

Characteristics

Name

CGJXvUhi

Size

17KB

Virtual Size

16KB

Characteristics

Name

ukrzpJoB

Size

28KB

Virtual Size

27KB

Characteristics

Name

GuPICjot

Size

57KB

Virtual Size

57KB

Characteristics

Name

ZcmEeNKj

Size

45KB

Virtual Size

44KB

Characteristics

Name

imAvGnBY

Size

2KB

Virtual Size

1KB

Characteristics

Name

ycsaxIVa

Size

1KB

Virtual Size

1KB

Characteristics

Name

PAtCkyGF

Size

20KB

Virtual Size

19KB

Characteristics

Name

PQzBnzRm

Size

42KB

Virtual Size

42KB

Characteristics

Name

lvELgNaP

Size

128KB

Virtual Size

128KB

Characteristics

Name

YRhvjzWp

Size

46KB

Virtual Size

45KB

Characteristics

Name

qmtpBCdl

Size

43KB

Virtual Size

43KB

Characteristics

Name

DvAjtUkn

Size

13KB

Virtual Size

12KB

Characteristics

Name

wGLsFIMc

Size

58KB

Virtual Size

58KB

Characteristics

Name

bazcjlrZ

Size

37KB

Virtual Size

37KB

Characteristics

Name

GjdHXVji

Size

55KB

Virtual Size

55KB

Characteristics

Name

SODgnvVW

Size

75KB

Virtual Size

74KB

Characteristics

Name

EgEgCKgc

Size

111KB

Virtual Size

110KB

Characteristics

Name

gLwyhHCo

Size

47KB

Virtual Size

47KB

Characteristics

Name

upvZjeBx

Size

129KB

Virtual Size

128KB

Characteristics

Name

hzWJOiXi

Size

28KB

Virtual Size

28KB

Characteristics

Name

NznCbZJJ

Size

512B

Virtual Size

71B

Characteristics

Name

HTBhicBt

Size

63KB

Virtual Size

62KB

Characteristics

Name

odFgHOqZ

Size

30KB

Virtual Size

30KB

Characteristics

Name

dXRHzUFF

Size

31KB

Virtual Size

30KB

Characteristics

Name

BXekBvqa

Size

30KB

Virtual Size

29KB

Characteristics

Name

yeQXQtrW

Size

93KB

Virtual Size

93KB

Characteristics

Name

jhRClita

Size

2KB

Virtual Size

2KB

Characteristics

Name

MzQXqyEH

Size

18KB

Virtual Size

17KB

Characteristics

Name

QJuVQkwd

Size

50KB

Virtual Size

50KB

Characteristics

Name

IYEdEzSB

Size

62KB

Virtual Size

62KB

Characteristics

Name

EHUAflDA

Size

14KB

Virtual Size

13KB

Characteristics

Name

VecDFUyp

Size

56KB

Virtual Size

55KB

Characteristics

Name

ZKFzpjAn

Size

512B

Virtual Size

283B

Characteristics

Name

ngiSdeBw

Size

10KB

Virtual Size

9KB

Characteristics

Name

cxZzyaIH

Size

115KB

Virtual Size

114KB

Characteristics

Name

JYUTVgVX

Size

40KB

Virtual Size

40KB

Characteristics

Name

yRUlPwte

Size

1KB

Virtual Size

1KB

Characteristics

Name

TpfbyGoH

Size

27KB

Virtual Size

27KB

Characteristics

Name

KSTWMpTK

Size

512B

Virtual Size

14B

Characteristics

Name

xvVXLepS

Size

31KB

Virtual Size

30KB

Characteristics

Name

gcQawThu

Size

32KB

Virtual Size

31KB

Characteristics

Name

KmmRvNyK

Size

27KB

Virtual Size

27KB

Characteristics

Name

gLNFJDcW

Size

5KB

Virtual Size

5KB

Characteristics

Name

DRuhsAid

Size

2KB

Virtual Size

2KB

Characteristics

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

6d8032357e664749d95c74c3cc618231

kernel32

advapi32

shell32

wininet

generic