sakula | b22159318412b6e0ed004b2bb69d57bb

Sharing

Copy URL

Twitter E-mail

General

Target

b22159318412b6e0ed004b2bb69d57bb
Size

4.5MB
MD5

b22159318412b6e0ed004b2bb69d57bb
SHA1

48f2b5265b83a71541e4a0cb23c796a81dc11856
SHA256

d478e209178aa7b10018e4b0307e48566f1851b9934e13387516f39fe179b9ab
SHA512

6193ab544bf773da09741d604133590c2964b2bb27ff2b612a5934b0010fa3dd658a64231ee3e986ae96b9246b58fa9ba71d75bd99d592b9126a1427bbcfac66
SSDEEP

24576:0+9mrnE2Zjll/6b8h3UZrgEu8CkBW+M3nXvIMfhlG144EE/f5DBMY1:0Y2ZjlkWEZw8Jk+EXvIMfP4FRaY1

Score

10^/10

sakula

Malware Config

Signatures

Sakula family
sakula
Sakula payload 1 IoCs

Processes:

resource yara_rule

sample family_sakula
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

b22159318412b6e0ed004b2bb69d57bb

resource	yara_rule
sample	family_sakula

resource
b22159318412b6e0ed004b2bb69d57bb

Files

b22159318412b6e0ed004b2bb69d57bb
.exe windows:5 windows x86 arch:x86

539502771da573641ecc7f6497e39f8f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThread
VirtualFree
ExpandEnvironmentStringsA
WriteFile
OpenProcess
WideCharToMultiByte
GetVolumeInformationA
Sleep
SizeofResource
CreateProcessA
ReadFile
GetSystemDirectoryA
MultiByteToWideChar
SetThreadPriority
GetTickCount
GetStartupInfoA
FindFirstFileA
GetLastError
VirtualAlloc
FindClose
LockResource
CreatePipe
GetModuleFileNameA
GetVersionExA
WinExec
CloseHandle
GetCurrentProcessId
GetTempPathA
GetCurrentProcess
LoadResource
PeekNamedPipe
SetFilePointer
SetPriorityClass
FindResourceA
GetFileSize
CreateFileA
GetComputerNameA
CreateDirectoryA
ExitProcess
CreateFileW
GetProcessHeap
SetEndOfFile
HeapReAlloc
GetStringTypeW
LCMapStringW
FlushFileBuffers
WriteConsoleW
SetStdHandle
GetProcAddress
GetModuleHandleW
DecodePointer
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetStdHandle
GetModuleFileNameW
HeapCreate
RtlUnwind
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
IsProcessorFeaturePresent

advapi32

RegOpenKeyA
GetUserNameA
FreeSid
AllocateAndInitializeSid
RegDeleteKeyA
EqualSid
RegSetValueExA
GetTokenInformation
OpenProcessToken
RegCloseKey

shell32

SHChangeNotify
ord680
ShellExecuteA

wininet

HttpOpenRequestA
InternetOpenUrlA
HttpSendRequestA
InternetOpenA
InternetCloseHandle
InternetConnectA
InternetReadFile

Sections

.text
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

PZLsSIJV
Size: 30KB - Virtual size: 29KB

ziFVNxeu
Size: 46KB - Virtual size: 46KB

euSPraVC
Size: 61KB - Virtual size: 61KB

DBEWRgyU
Size: 518KB - Virtual size: 517KB

pnuANWeV
Size: 201KB - Virtual size: 200KB

mmfysDnX
Size: 78KB - Virtual size: 77KB

ObQONCoR
Size: 68KB - Virtual size: 67KB

nKCLwczS
Size: 24KB - Virtual size: 23KB

ACddplIf
Size: 15KB - Virtual size: 15KB

qksbcNRp
Size: 193KB - Virtual size: 193KB

OIDjawZm
Size: 11KB - Virtual size: 10KB

yjYJVpkb
Size: 6KB - Virtual size: 5KB

tiLEAjGH
Size: 59KB - Virtual size: 59KB

vkycqDyO
Size: 32KB - Virtual size: 31KB

FWIyxECt
Size: 53KB - Virtual size: 52KB

piVcJcPc
Size: 15KB - Virtual size: 14KB

AUSsVZVf
Size: 1024B - Virtual size: 656B

DZFmffox
Size: 342KB - Virtual size: 341KB

EFfZhVgq
Size: 116KB - Virtual size: 115KB

NwhgJkKy
Size: 166KB - Virtual size: 166KB

UqlPYfKf
Size: 54KB - Virtual size: 54KB

PGUNTULk
Size: 35KB - Virtual size: 34KB

zYneeMBn
Size: 5KB - Virtual size: 4KB

LjdeaVqP
Size: 33KB - Virtual size: 32KB

JOXAKlvW
Size: 2KB - Virtual size: 1KB

fqrtDhVn
Size: 22KB - Virtual size: 21KB

DoBLnvWq
Size: 2KB - Virtual size: 2KB

zowoNMsS
Size: 17KB - Virtual size: 16KB

LVzeMTLq
Size: 3KB - Virtual size: 2KB

WsRMVDpn
Size: 9KB - Virtual size: 9KB

VpMtQLyv
Size: 26KB - Virtual size: 26KB

PzGjttvH
Size: 62KB - Virtual size: 61KB

AjzzOrfj
Size: 71KB - Virtual size: 70KB

lOpHQnph
Size: 58KB - Virtual size: 57KB

faqZgHHE
Size: 36KB - Virtual size: 35KB

BBDDanGa
Size: 35KB - Virtual size: 35KB

NZlQiKhK
Size: 24KB - Virtual size: 23KB

iaBbAQHv
Size: 119KB - Virtual size: 119KB

ladtRKxI
Size: 58KB - Virtual size: 57KB

oXxqozfp
Size: 152KB - Virtual size: 151KB

aLHsAhxi
Size: 52KB - Virtual size: 52KB

BHlbNAJJ
Size: 340KB - Virtual size: 339KB

TkWLdJLS
Size: 9KB - Virtual size: 9KB

CXHSlvFX
Size: 13KB - Virtual size: 13KB

ooWNAVIQ
Size: 60KB - Virtual size: 59KB

SaEGzdmu
Size: 64KB - Virtual size: 63KB

BpVtSUyz
Size: 8KB - Virtual size: 7KB

sfuocicr
Size: 31KB - Virtual size: 31KB

OiVnHgUO
Size: 6KB - Virtual size: 5KB

EydpfPmY
Size: 2KB - Virtual size: 1KB

emfZKWve
Size: 55KB - Virtual size: 54KB

XNEqVXtq
Size: 52KB - Virtual size: 52KB

wTakWGNm
Size: 50KB - Virtual size: 49KB

NNZEwmTx
Size: 7KB - Virtual size: 7KB

RuNMmtPz
Size: 41KB - Virtual size: 41KB

zTLFMleF
Size: 44KB - Virtual size: 43KB

mGUoYsYs
Size: 17KB - Virtual size: 16KB

PFyNLJVg
Size: 262KB - Virtual size: 261KB

MSXJaTth
Size: 30KB - Virtual size: 30KB

UdFheWRg
Size: 2KB - Virtual size: 2KB

xmIMISOx
Size: 47KB - Virtual size: 46KB

iRsoKzhE
Size: 2KB - Virtual size: 1KB

xdEGOuIF
Size: 15KB - Virtual size: 15KB

suxIyJaF
Size: 5KB - Virtual size: 4KB

wUIxLOWy
Size: 333KB - Virtual size: 332KB

WNqrwJth
Size: 52KB - Virtual size: 52KB

kjWCXVQm
Size: 6KB - Virtual size: 6KB

Sharing

General

Malware Config

Signatures

Files

539502771da573641ecc7f6497e39f8f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

wininet

Sections

.text Size: 46KB - Virtual size: 46KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 6KB - Virtual size: 14KB

.rsrc Size: 11KB - Virtual size: 10KB

.reloc Size: 4KB - Virtual size: 3KB

PZLsSIJV Size: 30KB - Virtual size: 29KB

ziFVNxeu Size: 46KB - Virtual size: 46KB

euSPraVC Size: 61KB - Virtual size: 61KB

DBEWRgyU Size: 518KB - Virtual size: 517KB

pnuANWeV Size: 201KB - Virtual size: 200KB

mmfysDnX Size: 78KB - Virtual size: 77KB

ObQONCoR Size: 68KB - Virtual size: 67KB

nKCLwczS Size: 24KB - Virtual size: 23KB

ACddplIf Size: 15KB - Virtual size: 15KB

qksbcNRp Size: 193KB - Virtual size: 193KB

OIDjawZm Size: 11KB - Virtual size: 10KB

yjYJVpkb Size: 6KB - Virtual size: 5KB

tiLEAjGH Size: 59KB - Virtual size: 59KB

vkycqDyO Size: 32KB - Virtual size: 31KB

FWIyxECt Size: 53KB - Virtual size: 52KB

piVcJcPc Size: 15KB - Virtual size: 14KB

AUSsVZVf Size: 1024B - Virtual size: 656B

DZFmffox Size: 342KB - Virtual size: 341KB

EFfZhVgq Size: 116KB - Virtual size: 115KB

NwhgJkKy Size: 166KB - Virtual size: 166KB

UqlPYfKf Size: 54KB - Virtual size: 54KB

PGUNTULk Size: 35KB - Virtual size: 34KB

zYneeMBn Size: 5KB - Virtual size: 4KB

LjdeaVqP Size: 33KB - Virtual size: 32KB

JOXAKlvW Size: 2KB - Virtual size: 1KB

fqrtDhVn Size: 22KB - Virtual size: 21KB

DoBLnvWq Size: 2KB - Virtual size: 2KB

zowoNMsS Size: 17KB - Virtual size: 16KB

LVzeMTLq Size: 3KB - Virtual size: 2KB

WsRMVDpn Size: 9KB - Virtual size: 9KB

VpMtQLyv Size: 26KB - Virtual size: 26KB

PzGjttvH Size: 62KB - Virtual size: 61KB

AjzzOrfj Size: 71KB - Virtual size: 70KB

lOpHQnph Size: 58KB - Virtual size: 57KB

faqZgHHE Size: 36KB - Virtual size: 35KB

BBDDanGa Size: 35KB - Virtual size: 35KB

NZlQiKhK Size: 24KB - Virtual size: 23KB

iaBbAQHv Size: 119KB - Virtual size: 119KB

ladtRKxI Size: 58KB - Virtual size: 57KB

oXxqozfp Size: 152KB - Virtual size: 151KB

aLHsAhxi Size: 52KB - Virtual size: 52KB

BHlbNAJJ Size: 340KB - Virtual size: 339KB

TkWLdJLS Size: 9KB - Virtual size: 9KB

CXHSlvFX Size: 13KB - Virtual size: 13KB

ooWNAVIQ Size: 60KB - Virtual size: 59KB

SaEGzdmu Size: 64KB - Virtual size: 63KB

BpVtSUyz Size: 8KB - Virtual size: 7KB

sfuocicr Size: 31KB - Virtual size: 31KB

OiVnHgUO Size: 6KB - Virtual size: 5KB

EydpfPmY Size: 2KB - Virtual size: 1KB

emfZKWve Size: 55KB - Virtual size: 54KB

XNEqVXtq Size: 52KB - Virtual size: 52KB

wTakWGNm Size: 50KB - Virtual size: 49KB

NNZEwmTx Size: 7KB - Virtual size: 7KB

RuNMmtPz Size: 41KB - Virtual size: 41KB

zTLFMleF Size: 44KB - Virtual size: 43KB

mGUoYsYs Size: 17KB - Virtual size: 16KB

PFyNLJVg Size: 262KB - Virtual size: 261KB

MSXJaTth Size: 30KB - Virtual size: 30KB

UdFheWRg Size: 2KB - Virtual size: 2KB

.text
Size: 46KB - Virtual size: 46KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 6KB - Virtual size: 14KB

.rsrc
Size: 11KB - Virtual size: 10KB

.reloc
Size: 4KB - Virtual size: 3KB

PZLsSIJV
Size: 30KB - Virtual size: 29KB

ziFVNxeu
Size: 46KB - Virtual size: 46KB

euSPraVC
Size: 61KB - Virtual size: 61KB

DBEWRgyU
Size: 518KB - Virtual size: 517KB

pnuANWeV
Size: 201KB - Virtual size: 200KB

mmfysDnX
Size: 78KB - Virtual size: 77KB

ObQONCoR
Size: 68KB - Virtual size: 67KB

nKCLwczS
Size: 24KB - Virtual size: 23KB

ACddplIf
Size: 15KB - Virtual size: 15KB

qksbcNRp
Size: 193KB - Virtual size: 193KB

OIDjawZm
Size: 11KB - Virtual size: 10KB

yjYJVpkb
Size: 6KB - Virtual size: 5KB

tiLEAjGH
Size: 59KB - Virtual size: 59KB

vkycqDyO
Size: 32KB - Virtual size: 31KB

FWIyxECt
Size: 53KB - Virtual size: 52KB

piVcJcPc
Size: 15KB - Virtual size: 14KB

AUSsVZVf
Size: 1024B - Virtual size: 656B

DZFmffox
Size: 342KB - Virtual size: 341KB

EFfZhVgq
Size: 116KB - Virtual size: 115KB

NwhgJkKy
Size: 166KB - Virtual size: 166KB

UqlPYfKf
Size: 54KB - Virtual size: 54KB

PGUNTULk
Size: 35KB - Virtual size: 34KB

zYneeMBn
Size: 5KB - Virtual size: 4KB

LjdeaVqP
Size: 33KB - Virtual size: 32KB

JOXAKlvW
Size: 2KB - Virtual size: 1KB

fqrtDhVn
Size: 22KB - Virtual size: 21KB

DoBLnvWq
Size: 2KB - Virtual size: 2KB

zowoNMsS
Size: 17KB - Virtual size: 16KB

LVzeMTLq
Size: 3KB - Virtual size: 2KB

WsRMVDpn
Size: 9KB - Virtual size: 9KB

VpMtQLyv
Size: 26KB - Virtual size: 26KB

PzGjttvH
Size: 62KB - Virtual size: 61KB

AjzzOrfj
Size: 71KB - Virtual size: 70KB

lOpHQnph
Size: 58KB - Virtual size: 57KB

faqZgHHE
Size: 36KB - Virtual size: 35KB

BBDDanGa
Size: 35KB - Virtual size: 35KB

NZlQiKhK
Size: 24KB - Virtual size: 23KB

iaBbAQHv
Size: 119KB - Virtual size: 119KB

ladtRKxI
Size: 58KB - Virtual size: 57KB

oXxqozfp
Size: 152KB - Virtual size: 151KB

aLHsAhxi
Size: 52KB - Virtual size: 52KB

BHlbNAJJ
Size: 340KB - Virtual size: 339KB

TkWLdJLS
Size: 9KB - Virtual size: 9KB

CXHSlvFX
Size: 13KB - Virtual size: 13KB

ooWNAVIQ
Size: 60KB - Virtual size: 59KB

SaEGzdmu
Size: 64KB - Virtual size: 63KB

BpVtSUyz
Size: 8KB - Virtual size: 7KB

sfuocicr
Size: 31KB - Virtual size: 31KB

OiVnHgUO
Size: 6KB - Virtual size: 5KB

EydpfPmY
Size: 2KB - Virtual size: 1KB

emfZKWve
Size: 55KB - Virtual size: 54KB

XNEqVXtq
Size: 52KB - Virtual size: 52KB

wTakWGNm
Size: 50KB - Virtual size: 49KB

NNZEwmTx
Size: 7KB - Virtual size: 7KB

RuNMmtPz
Size: 41KB - Virtual size: 41KB

zTLFMleF
Size: 44KB - Virtual size: 43KB

mGUoYsYs
Size: 17KB - Virtual size: 16KB

PFyNLJVg
Size: 262KB - Virtual size: 261KB

MSXJaTth
Size: 30KB - Virtual size: 30KB

UdFheWRg
Size: 2KB - Virtual size: 2KB

xmIMISOx
Size: 47KB - Virtual size: 46KB

iRsoKzhE
Size: 2KB - Virtual size: 1KB

xdEGOuIF
Size: 15KB - Virtual size: 15KB

suxIyJaF
Size: 5KB - Virtual size: 4KB

wUIxLOWy
Size: 333KB - Virtual size: 332KB

WNqrwJth
Size: 52KB - Virtual size: 52KB

kjWCXVQm
Size: 6KB - Virtual size: 6KB