sakula | b513e34939f4c8db1c0a0043aca5ee50

General

Target
b513e34939f4c8db1c0a0043aca5ee50
Size 304KB
Sample231220-p5e7cafdb2
SHA256 33c8ace830117c2b62deb9447d1319803cd82cf996213fd2dd7bb6c99933b346
MD5 b513e34939f4c8db1c0a0043aca5ee50
SHA1 204659586b81770e2e967ee13e7d43d2c61b377f
SHA512 81b7c0ab70ea0e630e9a85b39e5237b26efddc7098ebbc0acbcc16070b8d0e74383d4526c0c5cda0213f0f97c8a413abb01b3cf3169de2cde87bc8ca4ea456a9
SSDEEP 6144:M29qRfVSndj30B3wBxE1+ijiBKk3etdgI2MyzNORQtOfl1qNVo7R+S+N/B:0RfQn+w8EYiBld
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula

Malware Config

Extracted

Family

sakula

C2

www.polarroute.com

Signatures

Sakula family
sakula

Sakula payload 1 IoCs

resource	yara_rule
sample	family_sakula

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b513e34939f4c8db1c0a0043aca5ee50

File Explorer

b513e34939f4c8db1c0a0043aca5ee50

.exe 304KB

b513e34939f4c8db1c0a0043aca5ee50

IMPHASH 4511896d043677e4ab4578dc5bcab5a0
SHA256 33c8ace830117c2b62deb9447d1319803cd82cf996213fd2dd7bb6c99933b346
MD5 b513e34939f4c8db1c0a0043aca5ee50
SHA1 204659586b81770e2e967ee13e7d43d2c61b377f
SHA512 81b7c0ab70ea0e630e9a85b39e5237b26efddc7098ebbc0acbcc16070b8d0e74383d4526c0c5cda0213f0f97c8a413abb01b3cf3169de2cde87bc8ca4ea456a9
SSDEEP 6144:M29qRfVSndj30B3wBxE1+ijiBKk3etdgI2MyzNORQtOfl1qNVo7R+S+N/B:0RfQn+w8EYiBld
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Sakula payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

18234

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentThread VirtualFree ExpandEnvironmentStringsA WriteFile OpenProcess WideCharToMultiByte GetVolumeInformationA Sleep SizeofResource CreateProcessA TerminateProcess ReadFile GetSystemDirectoryA MultiByteToWideChar GetTickCount CreateDirectoryA GetStartupInfoA FindFirstFileA GetLastError VirtualAlloc FindClose LockResource CreatePipe GetModuleFileNameA GetVersionExA WinExec CloseHandle GetCurrentProcessId GetTempPathA GetCurrentProcess LoadResource PeekNamedPipe SetFilePointer SetPriorityClass FindResourceA GetFileSize CreateFileA GetComputerNameA SetThreadPriority ExitProcess GetProcessHeap SetEndOfFile GetStringTypeW GetStringTypeA GetModuleHandleW GetProcAddress HeapFree HeapAlloc GetSystemTimeAsFileTime GetCommandLineA UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetStdHandle DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryA InitializeCriticalSectionAndSpinCount HeapCreate HeapReAlloc RtlUnwind GetConsoleCP GetConsoleMode SetHandleCount GetFileType FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers LCMapStringA LCMapStringW

advapi32

RegOpenKeyA GetUserNameA FreeSid AllocateAndInitializeSid RegDeleteKeyA EqualSid RegSetValueExA GetTokenInformation OpenProcessToken RegCloseKey

shell32

SHChangeNotify ord680 ShellExecuteA

wininet

HttpOpenRequestA InternetOpenUrlA HttpSendRequestA InternetOpenA InternetCloseHandle InternetConnectA InternetReadFile

Sharing