Behavioral task
behavioral1
Sample
2b6862758d7e1fa0b613e8ef792cc1c36a85e6c0806094fb9cbe5c36045e1dbf.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2b6862758d7e1fa0b613e8ef792cc1c36a85e6c0806094fb9cbe5c36045e1dbf.exe
Resource
win10v2004-20240802-en
General
-
Target
cb9ecf13134922777a9e8f656844275a.zip
-
Size
1.2MB
-
MD5
21b82e14b4d6b9fc43d509802dfdefca
-
SHA1
c1729e849d0ae71bad2b63ebaf89c142ce68627a
-
SHA256
77e9abe775b215cb41e49de45e5e4f1d1163cc1e09ce6021351823701723b533
-
SHA512
11f53a114e7c61fc428bc811a35f1bb75971e473f803f11d01bee7b8c18f39afb3c4671fe221091e0f97e6199b87c9a0752afecdf499e9f77f7e2e7f9ea2e5e3
-
SSDEEP
24576:UMJLqvKOMxo6foh9Mw3VHsTuFyDFQlTMQHkNw/Fxu20/MHdVvH0I2KhThGRagX:pJevLqo6foh9vVHQu0k2w/Fh00HfPhT4
Malware Config
Signatures
-
Sakula family
-
Sakula payload 1 IoCs
Processes:
resource yara_rule static1/unpack001/2b6862758d7e1fa0b613e8ef792cc1c36a85e6c0806094fb9cbe5c36045e1dbf family_sakula -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/2b6862758d7e1fa0b613e8ef792cc1c36a85e6c0806094fb9cbe5c36045e1dbf
Files
-
cb9ecf13134922777a9e8f656844275a.zip.zip
Password: infected
-
2b6862758d7e1fa0b613e8ef792cc1c36a85e6c0806094fb9cbe5c36045e1dbf.exe windows:5 windows x86 arch:x86
Password: infected
539502771da573641ecc7f6497e39f8f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentThread
VirtualFree
ExpandEnvironmentStringsA
WriteFile
OpenProcess
WideCharToMultiByte
GetVolumeInformationA
Sleep
SizeofResource
CreateProcessA
ReadFile
GetSystemDirectoryA
MultiByteToWideChar
SetThreadPriority
GetTickCount
GetStartupInfoA
FindFirstFileA
GetLastError
VirtualAlloc
FindClose
LockResource
CreatePipe
GetModuleFileNameA
GetVersionExA
WinExec
CloseHandle
GetCurrentProcessId
GetTempPathA
GetCurrentProcess
LoadResource
PeekNamedPipe
SetFilePointer
SetPriorityClass
FindResourceA
GetFileSize
CreateFileA
GetComputerNameA
CreateDirectoryA
ExitProcess
CreateFileW
GetProcessHeap
SetEndOfFile
HeapReAlloc
GetStringTypeW
LCMapStringW
FlushFileBuffers
WriteConsoleW
SetStdHandle
GetProcAddress
GetModuleHandleW
DecodePointer
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetStdHandle
GetModuleFileNameW
HeapCreate
RtlUnwind
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
IsProcessorFeaturePresent
advapi32
RegOpenKeyA
GetUserNameA
FreeSid
AllocateAndInitializeSid
RegDeleteKeyA
EqualSid
RegSetValueExA
GetTokenInformation
OpenProcessToken
RegCloseKey
shell32
SHChangeNotify
ord680
ShellExecuteA
wininet
HttpOpenRequestA
InternetOpenUrlA
HttpSendRequestA
InternetOpenA
InternetCloseHandle
InternetConnectA
InternetReadFile
Sections
.text Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ZPAFZkHb Size: 25KB - Virtual size: 25KB
FgOtCMnJ Size: 118KB - Virtual size: 117KB
qifHzdfC Size: 23KB - Virtual size: 22KB
PmLTNNwN Size: 449KB - Virtual size: 449KB
CAeRsksy Size: 131KB - Virtual size: 131KB
WNqgksdF Size: 306KB - Virtual size: 306KB
zAPRRXXX Size: 37KB - Virtual size: 36KB
BtRJRpXY Size: 1024B - Virtual size: 802B
nZodfacz Size: 39KB - Virtual size: 39KB
MyTvqJIO Size: 292KB - Virtual size: 292KB
fhPRWJFV Size: 42KB - Virtual size: 42KB
zMJCkwcK Size: 6KB - Virtual size: 5KB
yCQRfCkV Size: 27KB - Virtual size: 27KB
TdPTxZqh Size: 57KB - Virtual size: 57KB
ASeJycBq Size: 7KB - Virtual size: 6KB
lSLAzqpH Size: 16KB - Virtual size: 15KB
NxgbgIeO Size: 512B - Virtual size: 416B
hymexttH Size: 213KB - Virtual size: 212KB
InAHxrlU Size: 78KB - Virtual size: 77KB
iTunkIJj Size: 178KB - Virtual size: 177KB
alQxpkWX Size: 20KB - Virtual size: 19KB
UEWyXZeV Size: 15KB - Virtual size: 14KB
AFQLMBti Size: 10KB - Virtual size: 9KB
NHNyXfRe Size: 31KB - Virtual size: 31KB
lXvRqYZy Size: 27KB - Virtual size: 27KB
PXNqkCiG Size: 19KB - Virtual size: 18KB
tVDBjIej Size: 16KB - Virtual size: 15KB
edGJjudG Size: 67KB - Virtual size: 66KB
HIRFPMoZ Size: 512B - Virtual size: 409B
VMpKpHwI Size: 38KB - Virtual size: 37KB
KzLElcrT Size: 31KB - Virtual size: 31KB
gQsogKnr Size: 76KB - Virtual size: 75KB
BIKDPCGr Size: 40KB - Virtual size: 39KB
NxLKMJnM Size: 8KB - Virtual size: 8KB
UCYVIBKx Size: 23KB - Virtual size: 22KB
KApSmErd Size: 27KB - Virtual size: 27KB
wMLiVkON Size: 14KB - Virtual size: 14KB
vhOQcfXX Size: 41KB - Virtual size: 40KB
ipaqzEpq Size: 44KB - Virtual size: 43KB
EvjarYER Size: 26KB - Virtual size: 26KB
lXmapncp Size: 44KB - Virtual size: 43KB
yIsJYAkW Size: 18KB - Virtual size: 17KB
SyLnYtqT Size: 30KB - Virtual size: 29KB
yxAWFzwo Size: 61KB - Virtual size: 61KB
EYIMnDPm Size: 36KB - Virtual size: 35KB
oEvVCkAF Size: 70KB - Virtual size: 70KB
UPUOufax Size: 24KB - Virtual size: 23KB
nLkQbmWq Size: 31KB - Virtual size: 30KB
LWYdwfOz Size: 298KB - Virtual size: 298KB
AQKrgCUY Size: 5KB - Virtual size: 4KB
GgvNSYhW Size: 2KB - Virtual size: 2KB
ONmmTCGG Size: 1024B - Virtual size: 747B
fgWNTWCw Size: 512B - Virtual size: 85B
LkGLaebU Size: 13KB - Virtual size: 13KB
GdoAtjCv Size: 6KB - Virtual size: 5KB
OwmEiuZH Size: 14KB - Virtual size: 13KB
IjBeGXEt Size: 7KB - Virtual size: 6KB
aDEwMCpw Size: 4KB - Virtual size: 4KB
dXkMVcvf Size: 22KB - Virtual size: 21KB
KQhVAKOK Size: 5KB - Virtual size: 4KB
PJbJuDKc Size: 38KB - Virtual size: 38KB
WjhoKUTs Size: 512B - Virtual size: 459B
HOHEwBTi Size: 32KB - Virtual size: 32KB
oQwqYdOF Size: 19KB - Virtual size: 18KB
RNncMaSg Size: 258KB - Virtual size: 258KB
FsjTZJCn Size: 24KB - Virtual size: 24KB
oIRklPgB Size: 2KB - Virtual size: 1KB