sakula | bf867e69a0281772a1cb85e0a566ad34

Sharing

Copy URL Twitter E-mail

General

Target
bf867e69a0281772a1cb85e0a566ad34
Size 4.5MB
Sample231220-rahebsdccl
SHA256 649c2ef6b04787808f2bb095ba64ad8d91d11cc9fa4c35a6ece16d6ccf6fd1f2
MD5 bf867e69a0281772a1cb85e0a566ad34
SHA1 f14483457c82a40c34a2876b56331477b1beca25
SHA512 3c114090a9c1654c1e67d7f5bb2be4d3856a0db8eb84903bb171284667817ab314cbebb59710fcee54c8ede0831437efcb7dba0f086905c2ac7b01f5912de37d
SSDEEP 24576:0+9mrnE2Zjll/6b8h3UZrgEu8CkBW+M3nXvIMfhlG144EE/f5DBMYp:0Y2ZjlkWEZw8Jk+EXvIMfP4FRaYp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula

Malware Config

Signatures

Sakula family
sakula

Sakula payload 1 IoCs

resource	yara_rule
sample	family_sakula

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bf867e69a0281772a1cb85e0a566ad34

File Explorer

bf867e69a0281772a1cb85e0a566ad34

.exe 4.5MB

bf867e69a0281772a1cb85e0a566ad34

IMPHASH 539502771da573641ecc7f6497e39f8f
SHA256 649c2ef6b04787808f2bb095ba64ad8d91d11cc9fa4c35a6ece16d6ccf6fd1f2
MD5 bf867e69a0281772a1cb85e0a566ad34
SHA1 f14483457c82a40c34a2876b56331477b1beca25
SHA512 3c114090a9c1654c1e67d7f5bb2be4d3856a0db8eb84903bb171284667817ab314cbebb59710fcee54c8ede0831437efcb7dba0f086905c2ac7b01f5912de37d
SSDEEP 24576:0+9mrnE2Zjll/6b8h3UZrgEu8CkBW+M3nXvIMfhlG144EE/f5DBMYp:0Y2ZjlkWEZw8Jk+EXvIMfP4FRaYp
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Sakula payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17029

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentThread VirtualFree ExpandEnvironmentStringsA WriteFile OpenProcess WideCharToMultiByte GetVolumeInformationA Sleep SizeofResource CreateProcessA ReadFile GetSystemDirectoryA MultiByteToWideChar SetThreadPriority GetTickCount GetStartupInfoA FindFirstFileA GetLastError VirtualAlloc FindClose LockResource CreatePipe GetModuleFileNameA GetVersionExA WinExec CloseHandle GetCurrentProcessId GetTempPathA GetCurrentProcess LoadResource PeekNamedPipe SetFilePointer SetPriorityClass FindResourceA GetFileSize CreateFileA GetComputerNameA CreateDirectoryA ExitProcess CreateFileW GetProcessHeap SetEndOfFile HeapReAlloc GetStringTypeW LCMapStringW FlushFileBuffers WriteConsoleW SetStdHandle GetProcAddress GetModuleHandleW DecodePointer HeapFree HeapAlloc GetSystemTimeAsFileTime GetCommandLineA HeapSetInformation GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetStdHandle GetModuleFileNameW HeapCreate RtlUnwind GetConsoleCP GetConsoleMode SetHandleCount GetFileType FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize IsProcessorFeaturePresent

advapi32

RegOpenKeyA GetUserNameA FreeSid AllocateAndInitializeSid RegDeleteKeyA EqualSid RegSetValueExA GetTokenInformation OpenProcessToken RegCloseKey

shell32

SHChangeNotify ord680 ShellExecuteA

wininet

HttpOpenRequestA InternetOpenUrlA HttpSendRequestA InternetOpenA InternetCloseHandle InternetConnectA InternetReadFile

Name

.text

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

PZLsSIJV

Size

30KB

Virtual Size

29KB

Characteristics

Name

ziFVNxeu

Size

46KB

Virtual Size

46KB

Characteristics

Name

euSPraVC

Size

61KB

Virtual Size

61KB

Characteristics

Name

DBEWRgyU

Size

518KB

Virtual Size

517KB

Characteristics

Name

pnuANWeV

Size

201KB

Virtual Size

200KB

Characteristics

Name

mmfysDnX

Size

78KB

Virtual Size

77KB

Characteristics

Name

ObQONCoR

Size

68KB

Virtual Size

67KB

Characteristics

Name

nKCLwczS

Size

24KB

Virtual Size

23KB

Characteristics

Name

ACddplIf

Size

15KB

Virtual Size

15KB

Characteristics

Name

qksbcNRp

Size

193KB

Virtual Size

193KB

Characteristics

Name

OIDjawZm

Size

11KB

Virtual Size

10KB

Characteristics

Name

yjYJVpkb

Size

6KB

Virtual Size

5KB

Characteristics

Name

tiLEAjGH

Size

59KB

Virtual Size

59KB

Characteristics

Name

vkycqDyO

Size

32KB

Virtual Size

31KB

Characteristics

Name

FWIyxECt

Size

53KB

Virtual Size

52KB

Characteristics

Name

piVcJcPc

Size

15KB

Virtual Size

14KB

Characteristics

Name

AUSsVZVf

Size

1024B

Virtual Size

656B

Characteristics

Name

DZFmffox

Size

342KB

Virtual Size

341KB

Characteristics

Name

EFfZhVgq

Size

116KB

Virtual Size

115KB

Characteristics

Name

NwhgJkKy

Size

166KB

Virtual Size

166KB

Characteristics

Name

UqlPYfKf

Size

54KB

Virtual Size

54KB

Characteristics

Name

PGUNTULk

Size

35KB

Virtual Size

34KB

Characteristics

Name

zYneeMBn

Size

5KB

Virtual Size

4KB

Characteristics

Name

LjdeaVqP

Size

33KB

Virtual Size

32KB

Characteristics

Name

JOXAKlvW

Size

2KB

Virtual Size

1KB

Characteristics

Name

fqrtDhVn

Size

22KB

Virtual Size

21KB

Characteristics

Name

DoBLnvWq

Size

2KB

Virtual Size

2KB

Characteristics

Name

zowoNMsS

Size

17KB

Virtual Size

16KB

Characteristics

Name

LVzeMTLq

Size

3KB

Virtual Size

2KB

Characteristics

Name

WsRMVDpn

Size

9KB

Virtual Size

9KB

Characteristics

Name

VpMtQLyv

Size

26KB

Virtual Size

26KB

Characteristics

Name

PzGjttvH

Size

62KB

Virtual Size

61KB

Characteristics

Name

AjzzOrfj

Size

71KB

Virtual Size

70KB

Characteristics

Name

lOpHQnph

Size

58KB

Virtual Size

57KB

Characteristics

Name

faqZgHHE

Size

36KB

Virtual Size

35KB

Characteristics

Name

BBDDanGa

Size

35KB

Virtual Size

35KB

Characteristics

Name

NZlQiKhK

Size

24KB

Virtual Size

23KB

Characteristics

Name

iaBbAQHv

Size

119KB

Virtual Size

119KB

Characteristics

Name

ladtRKxI

Size

58KB

Virtual Size

57KB

Characteristics

Name

oXxqozfp

Size

152KB

Virtual Size

151KB

Characteristics

Name

aLHsAhxi

Size

52KB

Virtual Size

52KB

Characteristics

Name

BHlbNAJJ

Size

340KB

Virtual Size

339KB

Characteristics

Name

TkWLdJLS

Size

9KB

Virtual Size

9KB

Characteristics

Name

CXHSlvFX

Size

13KB

Virtual Size

13KB

Characteristics

Name

ooWNAVIQ

Size

60KB

Virtual Size

59KB

Characteristics

Name

SaEGzdmu

Size

64KB

Virtual Size

63KB

Characteristics

Name

BpVtSUyz

Size

8KB

Virtual Size

7KB

Characteristics

Name

sfuocicr

Size

31KB

Virtual Size

31KB

Characteristics

Name

OiVnHgUO

Size

6KB

Virtual Size

5KB

Characteristics

Name

EydpfPmY

Size

2KB

Virtual Size

1KB

Characteristics

Name

emfZKWve

Size

55KB

Virtual Size

54KB

Characteristics

Name

XNEqVXtq

Size

52KB

Virtual Size

52KB

Characteristics

Name

wTakWGNm

Size

50KB

Virtual Size

49KB

Characteristics

Name

NNZEwmTx

Size

7KB

Virtual Size

7KB

Characteristics

Name

RuNMmtPz

Size

41KB

Virtual Size

41KB

Characteristics

Name

zTLFMleF

Size

44KB

Virtual Size

43KB

Characteristics

Name

mGUoYsYs

Size

17KB

Virtual Size

16KB

Characteristics

Name

PFyNLJVg

Size

262KB

Virtual Size

261KB

Characteristics

Name

MSXJaTth

Size

30KB

Virtual Size

30KB

Characteristics

Name

UdFheWRg

Size

2KB

Virtual Size

2KB

Characteristics

Name

xmIMISOx

Size

47KB

Virtual Size

46KB

Characteristics

Name

iRsoKzhE

Size

2KB

Virtual Size

1KB

Characteristics

Name

xdEGOuIF

Size

15KB

Virtual Size

15KB

Characteristics

Name

suxIyJaF

Size

5KB

Virtual Size

4KB

Characteristics

Name

wUIxLOWy

Size

333KB

Virtual Size

332KB

Characteristics

Name

WNqrwJth

Size

52KB

Virtual Size

52KB

Characteristics

Name

kjWCXVQm

Size

6KB

Virtual Size

6KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

bf867e69a0281772a1cb85e0a566ad34

kernel32

advapi32

shell32

wininet

generic