Behavioral task
behavioral1
Sample
995acf1535e99250c84e55149cd66b0e5d17fdd4cfe20408f9b09d32f264beb9N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
995acf1535e99250c84e55149cd66b0e5d17fdd4cfe20408f9b09d32f264beb9N.exe
Resource
win10v2004-20241007-en
General
-
Target
995acf1535e99250c84e55149cd66b0e5d17fdd4cfe20408f9b09d32f264beb9N.exe
-
Size
102KB
-
MD5
a6d8bdd039c8ae93ef9215a3e371e7da
-
SHA1
1a223de3b1143e0ccd722cfcae1b11945be8d9ca
-
SHA256
0c77f38e48d8a180666eb7586627c2823a7feb94a8a9c60be5001ebc400bbd0e
-
SHA512
2df3e4b6bce7102d10a413b60601eafe6e2e3cd8f6599db08e320537c4a3b68e0bf06f9afab2229d3353a69ddfd75c47dcff6d1d58c77c03ee1fe211b665e918
-
SSDEEP
1536:jJbCiJVkgMaT2itTkjoRXnM48dXFajVPkPLnlxsz30rtrQ39z:tbfVk29te2juPLlxo30Bs39z
Malware Config
Extracted
sakula
www.savmpet.com
Signatures
-
Sakula family
-
Sakula payload 1 IoCs
Processes:
resource yara_rule sample family_sakula -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 995acf1535e99250c84e55149cd66b0e5d17fdd4cfe20408f9b09d32f264beb9N.exe
Files
-
995acf1535e99250c84e55149cd66b0e5d17fdd4cfe20408f9b09d32f264beb9N.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 95KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE