0 Results Found
            Back To Results
              Threat Analysis

              Sakula Malware Family

              • Author: Dell SecureWorks Counter Threat Unit™ Threat Intelligence
              • Date: 30 July 2015

              Summary

              Dell SecureWorks Counter Threat Unit™ (CTU™) researchers analyzed multiple versions of a remote access trojan (RAT) named Sakula (also known as Sakurel and VIPER). The RAT, which according to compile timestamps first surfaced in November 2012, has been used in targeted intrusions through 2015. Sakula enables an adversary to run interactive commands as well as to download and execute additional components.

              Sakula uses HTTP GET and POST communication for command and control (C2). Network communication is obfuscated with single-byte XOR encoding. Sakula also leverages single-byte XOR encoding to obfuscate various strings and files embedded in the resource section, which are subsequently used for User Account Control (UAC) bypass on both 32 and 64-bit systems. Most samples maintain persistence through a registry Run key, although some samples configure themselves as a service.

              Analysis

              CTU researchers performed detailed analysis on 346 Sakula samples, including the installer and all dropped files used by the malware to run. The earliest compilation timestamp is November 21, 2012. As of this publication, the most recent sample observed by CTU researchers was compiled on January 1, 2015. Some installers compiled in 2013 are configured to drop samples compiled in 2014, suggesting that the initial installer has been successful and that the adversary has a build process that permits them to easily re-use components. Multiple samples include their debug information, which yielded properties like LANG_NAME and SUBLANG_NAME (whose values are 'LANG_CHINESE' and 'SUBLANG_CHINESE_SIMPLIFIED', respectively).

              Delivery

              CTU researchers observed a copy of Sakula being delivered in a strategic web compromise (SWC) that exploited CVE-2014-0322, which was a zero-day vulnerability in Internet Explorer at the time of compromise. A subset of Sakula variants are digitally signed, allowing them to bypass security controls and providing users with a false sense of security that the software is legitimate. Table 1 lists the publisher names, thumbprints, and serial numbers used by Sakula to digitally sign its installer component.

              Publisher Thumbprint Serial number
              Career Credit Co 3203BA1693B76FCB68D33BE0B9E8F312EE97A9B9 01 A5 D9 59 95 19 B1 BA FC FA D0 E8 0B 6D 67 35
              DTOPTOOLZ Co. 6E752358D18B8B401A764ABE1AB9D6D5B42332C8 47 D5 D5 37 2B CB 15 62 B4 C9 F4 C2 BD F1 35 87
              MICRO DIGITAL INC. 3E49A89005AA19A9294F919ACE81169A33789638 31 06 2E 48 3E 01 06 B1 8C 98 2F 00 53 18 5C 36
              NexG 554C8DDCDD782FA3102D750D94551EDC9B8A608F 5E 3D 76 DC 7E 27 3E 2F 31 3F C0 77 58 47 A2 A2
              SJ SYSTEM 918BF759D590CC2D2240938C1A4310B49DB2ACC0 20 D0 EE 42 FC 90 1E 6B 3A 8F EF E8 C1 E6 08 7A
              U-Tech IT service AF7D3EC0D442C555E8E7337C571C2A72B32217D4 3A C1 0E 68 F1 CE 51 9E 84 DD CD 28 B1 1F A5 42

              Table 1. Signature properties of certificates used to sign Sakula malware.

              Some installers masqueraded as the following applications and used social engineering to convince users that the applications were required to do business:

              • Adobe Self Extractor
              • CITRIX Access Gateway Secure Input
              • Juniper SSL VPN ActiveX Plugin
              • Microsoft Hotfix
              • Security Exchange Mail Exchange ActiveX Control

              Figures 1 through 5 show the status windows that the Sakula installers display to victims.


              Figure 1. Screenshot of Sakula installer purporting to be installing Adobe software. (Source: Dell SecureWorks)



              Figure 2. Screenshot of Sakula installer purporting to be installing Juniper software. (Source: Dell SecureWorks)



              Figure 3. Screenshot of Sakula installer purporting to be installing Exchange software. (Source: Dell SecureWorks)



              Figure 4. Screenshot of Sakula installer purporting to be installing Juniper software. (Source: Dell SecureWorks)



              Figure 5. Screenshot of Sakula installer purporting to be installing a Microsoft ActiveX Control. (Source: Dell SecureWorks)


              Installation

              In most of the samples collected by the CTU research team, Sakula maintains persistence by setting the registry Run key (SOFTWARE\Microsoft\Windows\CurrentVersion\Run\) in either the HKLM or HKCU hive. The hive decision is based on the installer's ability to write to the %TEMP% directory. Through 2013, registry persistence was set using standard Windows APIs. In the samples compiled in 2014, the adversary switched to adding the Run key by invoking cmd.exe:

                cmd.exe /c reg add %s\Software\Microsoft\Windows\CurrentVersion\Run /v "%s" /t REG_SZ /d "%s"
                

              The registry value and filename vary by sample. CTU researchers extracted the following parameters:

              Values:

              • MicroMedia
              • JuniperACX
              • MicroSoftMedia
              • CCPUpdate
              • SenseSvc

              Filenames:

              • MediaCenter.exe
              • AdobeUpdate.exe
              • JuniperSafeACX.exe
              • MicroPlayerUpdate.exe
              • CitrixReciever.exe
              • SensrSvc.exe
              • SensrSvc2013.exe
              • MicroSoftSecurityLogin.ocx
              • Utmm.ocx
              • Sweep.exe
              • pdfforie.exe
              • shiape.exe

              In the cases where Sakula does not use a registry key for persistence, it attempts to set itself up as a service (see Table 2). It invokes itself by calling WinExec with the "net start %s" argument (without quotes), where "%s" is the service name.

              Service name Service description Filename and location
              AppleService Apple Application Service. C:\WINDOWS\system32\AppleService.exe
              Office Auto Update Microsoft Office Auto Update. C:\WINDOWS\system32\Sweep.exe

              Table 2. Properties used by Sakula when setting itself up as a service.

              Other than the service setup, the resident file location is fairly consistent across all samples. Most Sakula samples install their components within a directory under %TEMP%. The actual value of the environment variable is identified by an API call to ExpandEnvironmentStringsA. Three of the analyzed samples placed files in %APPDATA%, while the remaining Sakula samples placed files in a directory under %ALLUSERSPROFILE%. A small number of samples did not use an additional subdirectory. CTU researchers discovered Sakula files being installed under the following directory paths:

              • %TEMP%\MicroMedia\
              • %TEMP%\JuniperACX\
              • %TEMP%\MicroMedia\
              • %TEMP%\MicroSoftMedia\
              • %ALLUSERSPROFILE%\MicroMediaCCP\
              • %TEMP%\
              • %ALLUSERSPROFILE%\
              • %APPDATA%\

              The 2014 samples maintain persistence with the same SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ registry key, but Sakula leverages DLL side-loading, which involves running a legitimate, typically digitally signed, program that loads a malicious DLL. The legitimate application is a digitally signed sample of Kaspersky Anti-Virus (AV) 6.0 for Windows Workstations. When the Kaspersky application is run, it loads a file named msi.dll, which is located within the same directory. The msi.dll file is configured to read and XOR-decode setup.msi, also located in the same directory, and run it in memory. The XOR-decode process, which skips zeroes, uses the single-byte key 0x88.

              The 2015 sample differs from the 2014 samples in the files used and how the persistence mechanism is executed. Instead of the Kaspersky application, the 2015 sample uses a legitimately signed file from McAfee's Outlook Scan About Box application. Sakula names this file either MicroWhoknow.dll or Emabout.dll. There are two additional files within the same directory. The first, shutil.dll, is loaded by MicroWhoknow.dll or Emabout.dll and is configured to read and XOR-decrypt Thumbs.db using the same XOR key value as setup.msi. The other is the registry key used for persistence, which uses VBScript to call cmd.exe to run a DLL via the rundll32 application, passing the Plugupdate export within the MicroWhoKnow.dll as its entry point:

                HKU\Software\Microsoft\Windows\CurrentVersion\Run\MicroWhoknow: "mshta vbscript:CreateObject("WScript.Shell").Run("cmd /c cd C:\Users\user\AppData\Local\Temp\MicroWhoknow && rundll32 MicroWhoknow.dll Plugupdate",0)(window.close)"

              Multiple samples contain UAC bypass code for both 32 and 64-bit systems. The UAC bypass code is stored as 'DAT' in the file's resource section. The two DLLs are stored in separate items, identified as 101 and 102. The files are single-byte XOR-encoded with the value 0x24. The decode process skips hex bytes identical to the XOR key and zeroes. Based on whether the compromised system is 32-bit or 64-bit, the appropriate file is written and run using cmd.exe calling rundll32 on the DLL with the PlayWin32 or PlayWin64 export.

              Persistence for the UAC bypass DLL file is maintained via a SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ registry key in the HKLM or HKCU hive, with the value "CCPUpdate". Other Sakula variants temporarily write the files to disk and execute each time the main Sakula application is called. In these cases, the temporary file is written to the %TEMP% directory, and the filename is a combination of numbers generated from a call to GetTickCount and the '.dat' extension (e.g., 2225260.dat). In some instances, the filename is prefaced with the word "Center" (e.g., Center509671.dat).

              In a small group of Sakula samples from 2013, the install process also modified the hosts file to point some of the victim's subdomains to various IP addresses within the victim's own organization. The malware also registered a file as a command component within the registry.

              In the Sakula samples where the install process performed cleanup, the malware invoked cmd.exe. This process was instantiated by first performing a ping request to localhost to ensure the install process completed before the temporary file was deleted:

                C:\WINDOWS\system32\cmd.exe" /c ping 127.0.0.1 & del /q %TEMP%\Center73946.dat
                
                
                    

              On a subset of samples compiled in 2014, Sakula invoked the default web browser, which loaded a hard-coded URL. This action occurred after the seemingly legitimate application (discussed in the Delivery section) finished installing. Of the following URLs hard-coded within the malware, only the first three appeared to be under the adversary's control:

              • http:// www . qzbwcq . com/cookie.html
              • http:// sharepoint-vaeit . com/login.php?ref
              • http:// extcitrix . we11point . com/vpn/index.php?ref=1
              • https:// portal . caci . com/
              • https:// webmail . mfa . gov . mn/
              • http:// cabinet . gov . mn/mfa-gov/Success.html
              • http:// www . bisononthevinayerd . org/BisonOntheVineyard.pdf

              Capabilities

              Sakula obfuscates many of its strings using single-byte XOR obfuscation. Samples with a 2012 compile timestamp use a key value of either 0x88 or 0x56. Samples compiled in 2013 and 2014 use a key value of 0x56, while the lone 2015 sample uses 0x57.

              Core functionality across all Sakula samples is fairly consistent. While there are some minor differences among the samples, Sakula typically implements eight commands (see Table 3).

              Case Description
              1 Invoke a remote shell via named pipe with optional command
              2 Download and execute (randomly named file in %TEMP%)
              3 Upload a file by path
              4 Call WinExec on file
              5 Update C2 OR C2 beacon interval
              6 Uninstall and exit
              7 Get information about self (PID/filename)
              8 Invoke a remote shell OR sleep

              Table 3. Command functionality available in Sakula samples analyzed by CTU researchers.

              The "OR" in Table 3 indicates that the feature for that case varied by sample. For Case 2, the randomly named file is generated each time the command is used. It is sourced from a call to GetTickCount and is appended with ".exe". Case 8 was observed in samples compiled in mid-2013, with the Sleep command introduced in the only 2015 sample identified as of this publication.

              Command and control

              Sakula uses HTTP GET and POST for command and control, with most samples configured with only one C2 server. The network communications are encoded with the single-byte XOR keys listed in Table 4.

              XOR key value Observed sample year (based on compile time)
              0x59 2012 and 2013
              0x56 2013 and 2014
              0x66 2014
              0x5C 2014
              0x7C 2015

              Table 4. Single-byte XOR keys used to decode network traffic.

              The URI patterns used to communicate with the C2 server are fairly consistent across all samples regardless of compile time. Table 5 lists a breakdown of format by HTTP method in the analyzed Sakula samples.

              HTTP method URI request format
              POST /check.asp?imageid=%s&type=%d
              POST /newimage.asp?imageid=%s&type=%d&resid=%d
              POST /news/view.asp?cookie=%s&type=%d&vid=%d
              POST /script.asp?imageid=%s&type=%d&resid=%d&nmsg=up
              POST /update.asp?cstring=%s&tom=%d&id=%d
              POST /view.asp?cookie=%s&type=%d&vid=%d
              GET /news/photo/%s.jpg?vid=%d
              GET /photo/%s.jpg
              GET /photo/%s.jpg?id=%d
              GET /photo/%s.jpg?resid=%d
              GET /script.asp?resid=%d&nmsg=del&photoid=%s
              GET /view.asp?cstring=%s&tom=0&id=%d
              GET /viewphoto.asp?photoid=%s
              GET /viewphoto.asp?resid=%d&photoid=%s
              GET /x0x/%s.jpg?id=%d

              Table 5. Sakula URI formats by HTTP method. URIs using %s insert a string of characters, and %d insert digits.

              Sakula uses hard-coded User-Agents in its C2 communications but did not mimic standard browser User-Agents until 2014:

              • iexplorer
              • Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+SV1)
              • Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)

              Conclusion

              The Sakula RAT has been in use since 2012 with very few changes to the code base, which indicates that it is effective in targeted intrusions. Simplistic in nature, the small command set for Sakula allows its operator to actively control a compromised system, download and execute additional components, and hide in plain sight with single-byte XOR-encoded HTTP GET and POST C2 communications.

              Threat indicators

              The threat indicators in Table 6 can be used to detect activity related to Sakula. The IP addresses and domains may contain malicious content, so consider the risks before opening them in a browser.

              Indicator Type Context
              104.128.233.4 IP address Sakula C2 server
              115.47.35.117 IP address Sakula C2 server
              180.210.206.246 IP address Sakula C2 server
              23.27.112.143 IP address Sakula C2 server
              secure.devpia.com Domain name Sakula C2 server
              login.qzbwcq.com Domain name Sakula C2 server
              oa.ameteksen.com Domain name Sakula C2 server
              sinmoung.com Domain name Sakula C2 server
              extcitrix.we11point.com Domain name Sakula decoy page
              sharepoint-vaeit.com Domain name Sakula decoy page
              citrix.vipreclod.com Domain name Sakula C2 server
              update.microsoft.co.kr Domain name Sakula C2 server
              web.vipreclod.com Domain name Sakula C2 server
              www.huchin.com Domain name Sakula C2 server
              www.northpoleroute.com Domain name Sakula C2 server
              www.polarroute.com Domain name Sakula C2 server
              www.qzbwcq.com Domain name Sakula decoy page
              www.savmpet.com Domain name Sakula C2 server
              www.we11point.com Domain name Sakula C2 server
              iexplorer User-Agent Hard-coded Sakula User-Agent
              Mozilla/4.0+(compatible;+MSIE+8.0;
              +Windows+NT+5.1;+SV1)
              User-Agent Hard-coded Sakula User-Agent
              /check.asp?imageid=%s&type=%d URI Sakula hard-coded POST request format
              /newimage.asp?imageid=%s&type=%d&resid=%d URI Sakula hard-coded POST request format
              /news/view.asp?cookie=%s&type=%d&vid=%d URI Sakula hard-coded POST request format
              /script.asp?imageid=%s&type=%d&resid=%d&nmsg=up URI Sakula hard-coded POST request format
              /update.asp?cstring=%s&tom=%d&id=%d URI Sakula hard-coded POST request format
              /view.asp?cookie=%s&type=%d&vid=%d URI Sakula hard-coded POST request format
              /news/photo/%s.jpg?vid=%d URI Sakula hard-coded GET request format
              /photo/%s.jpg URI Sakula hard-coded GET request format
              /photo/%s.jpg?id=%d URI Sakula hard-coded GET request format
              /photo/%s.jpg?resid=%d URI Sakula hard-coded GET request format
              /script.asp?resid=%d&nmsg=del&photoid=%s URI Sakula hard-coded GET request format
              /viewphoto.asp?photoid=%s URI Sakula hard-coded GET request format
              /view.asp?cstring=%s&tom=0&id=%d URI Sakula hard-coded GET request format
              /viewphoto.asp?resid=%d&photoid=%s URI Sakula hard-coded GET request format
              /x0x/%s.jpg?id=%d URI Sakula hard-coded GET request format
              Career Credit Co Publisher name Used to digitally sign Sakula malware
              DTOPTOOLZ Co. Publisher name Used to digitally sign Sakula malware
              MICRO DIGITAL INC. Publisher name Used to digitally sign Sakula malware
              NexG Publisher name Used to digitally sign Sakula malware
              SJ SYSTEM Publisher name Used to digitally sign Sakula malware
              U-Tech IT service Publisher name Used to digitally sign Sakula malware
              HKU\Software\Microsoft\Windows\CurrentVersion\
              Run\MicroWhoknow: "mshta vbscript:CreateObject("WScript.Shell").Run("cmd /c cd C:\Users\user\AppData\Local\Temp\MicroWhoknow && rundll32 MicroWhoknow.dll Plugupdate",0)(window.close)"
              Registry key Used by Sakula to maintain persistence
              %TEMP%\MicroMedia\ Path Sakula malware installation path
              %TEMP%\JuniperACX\ Path Sakula malware installation path
              %TEMP%\MicroMedia\ Path Sakula malware installation path
              %TEMP%\MicroSoftMedia\ Path Sakula malware installation path
              %ALLUSERSPROFILE%\MicroMediaCCP\ Path Sakula malware installation path
              031832adb059c8a30bf06e3036813a05 MD5 hash Sakula malware
              034b2d2c7b1b6812d242771fbc382183 MD5 hash Sakula malware
              04f17c37259533e301b01a8c64e476e6 MD5 hash Sakula malware
              065aa01311ca8f3e0016d8ae546d30a4 MD5 hash Sakula malware
              07af666d2117296a7814c86839ee2ae0 MD5 hash Sakula malware
              07b62497e41898c22e5d5351607aac8e MD5 hash Sakula installer
              0a8a4cfa745b6350bea1b47f5754595e MD5 hash Sakula malware
              0ae8ace203031f32e9b1ac5696c0c070 MD5 hash Sakula malware
              0b6a0ca44e47609910d978ffb1ee49c6 MD5 hash Sakula malware
              0c693b4ee77c1ebb646334ce28331d5c MD5 hash Sakula malware
              0db52e612d904f4d4212beee4bd5c35c MD5 hash Sakula malware
              0e5d1b941dcb597eb9b7dc1f0694c65f MD5 hash Sakula malware
              0f218e73da96af2939e75ebea7c958dc MD5 hash Sakula malware
              0ff96f4dbfe8aa9c49b489218d862cd7 MD5 hash Sakula malware
              1098e66986134d71d4a8dd07301640b1 MD5 hash Sakula malware
              11587f16f3129cad17222498eadc84f2 MD5 hash XOR-encoded UAC bypass code for Sakula
              124089995494be38d866de08c12f99ef MD5 hash Sakula malware
              1240fbbabd76110a8fc29803e0c3ccfb MD5 hash Sakula malware
              127cd711193603b4725094dac1bd26f6 MD5 hash Sakula malware
              1377e513f872a062c6377d1e240225a8 MD5 hash Sakula malware
              13e99782f29efa20a2753ac00d1c05a0 MD5 hash Sakula malware
              15ccb0918411b859bab268195957c731 MD5 hash Sakula malware
              1893cf1d00980926f87c294c786892d2 MD5 hash Sakula malware
              191696982f3f21a6ac31bf3549c94108 MD5 hash Sakula malware
              194f79e5f043efecb5707ebc4f9d0573 MD5 hash Sakula malware
              1a6c43b693bb49dad5fe1637b02da2c6 MD5 hash Sakula malware
              1ab782431ed9948bf68196e1aa27cbc9 MD5 hash Sakula malware
              1affacbe9e5889d2e1b7045a828c7252 MD5 hash Sakula malware
              1d016bb286980fd356cab21cdfcb49f4 MD5 hash Sakula installer
              1d80af301994f9b6bf3fa2389ff125da MD5 hash XOR-encoded UAC bypass code for Sakula
              1de5db7cef81645f3f0e7aabdb7551a8 MD5 hash Sakula malware
              205c9b07c449a9c270aabe923123c0c1 MD5 hash Sakula malware
              230d4212692c867219aba739c57f0792 MD5 hash Sakula malware
              230d8a7a60a07df28a291b13ddf3351f MD5 hash Sakula installer
              2567d2bbcce5c8e7dcabcd2c1db2a98a MD5 hash Sakula malware
              259ea5f6f3f1209de99d6eb27a301cb7 MD5 hash Sakula malware
              2798fa07d5708f7be69ba525e5452d13 MD5 hash Sakula malware
              28771cb939b989e2ab898408ccaf5504 MD5 hash Sakula malware
              2d619b2c648d095fa2fb2e0864dbc7c9 MD5 hash Sakula malware
              2ffea14b33b78f2e2c92aead708a487a MD5 hash Sakula malware
              34db8fb5635c7f0f76a07808b35c8e55 MD5 hash Sakula malware
              352411e5288b2c6ea5571a2838c8f7f3 MD5 hash Sakula malware
              360273db9ac67e1531257323324d9f62 MD5 hash Sakula malware
              3759833848a8cd424bf973d66e983e91 MD5 hash Sakula malware
              379d4a0f24bb56569d6139946b7ccf88 MD5 hash Sakula malware
              388a7ae6963fd4da3ec0a4371738f4e0 MD5 hash Sakula malware
              391c01bdbeb5975c85cee0099adb132c MD5 hash Sakula malware
              3b70ab484857b6e96e62e239c937dea6 MD5 hash Sakula malware
              3cd598e8e2fd033134d8784251eff59e MD5 hash Sakula malware
              3ce08f804c5986856a85e16a4e211334 MD5 hash Sakula malware
              3d2c2fdd4104978762b89804ba771e63 MD5 hash Sakula installer
              3e0016d728b979b7f8fd77a2738047eb MD5 hash Sakula malware
              3f0ba1cd12bab7ba5875d1b02e45dfcf MD5 hash Sakula installer
              3fc6405499c25964dfe5d37ee0613a59 MD5 hash Sakula malware
              41093a982526c6dc7dbcf4f63814d428 MD5 hash Sakula malware
              419ce8f53d5585abd144e9e76113639d MD5 hash Sakula malware
              4297e98e6d7ea326dee3d13e53aa8d70 MD5 hash Sakula malware
              42d3e38db9f1d26f82ef47f0a0ec0499 MD5 hash Sakula malware
              4315274a5eda74cd81a5ec44980876e8 MD5 hash Sakula malware
              442f10bfc2a02831b6a733d6c01b0c59 MD5 hash Sakula malware
              45468c2450e6451cf63d2b9b2b70c632 MD5 hash Sakula malware
              49c5da72aafabcc0b6896fec637ed167 MD5 hash Sakula installer
              4a6f45ff62e9ab9fe48f1b91b31d110e MD5 hash Sakula malware
              4a7b4635af040cba1851b2f57254ba5e MD5 hash Sakula installer
              4c15781cb47d4a7604788e188fc722de MD5 hash Sakula malware
              4dc526eb9d04f022df9fa2518854bbb4 MD5 hash Sakula malware
              4e239b731a0f1dbf26b503d5e2a81514 MD5 hash Sakula malware
              4ea3afbed7a0c7d0013f454060243fba MD5 hash Sakula installer
              4f545dff49f81d08736a782751450f71 MD5 hash Sakula installer
              51ee4ef7f326e90d391ee9d1c5238b34 MD5 hash Decoded UAC bypass DLL file for Sakula
              5382efbecccf8227c7adc443e229542f MD5 hash Sakula malware
              5482deee917c374bab43dd83a4a6c722 MD5 hash Sakula malware
              586c418bf947a0ef73afd2a7009c4439 MD5 hash Sakula malware
              5acc539355258122f8cdc7f5c13368e1 MD5 hash Sakula installer
              5b27234b7f28316303351ea8bcfaa740 MD5 hash Sakula malware
              5d04457e3d4026a82ac3ec9b1c0819ec MD5 hash Sakula malware
              5d54c0756fbe33aae5dc8a4484a7aee5 MD5 hash Decoded UAC bypass DLL file for Sakula
              5dbdc2839e3f5c2dd35f3def42002663 MD5 hash Sakula malware
              5e1c170d96b0faea3a1281d182c29e02 MD5 hash Sakula malware
              606b9759de1aa61a76cf4afa4ccf8601 MD5 hash Sakula malware
              61fe6f4cb2c54511f0804b1417ab3bd2 MD5 hash Sakula malware
              63ae83244a8d7ca1eef4e834eb0eb07f MD5 hash Sakula malware
              63c0978e2fa715a3cad6fb3068f70961 MD5 hash Sakula malware
              64201ec97467910e74f40140c4aaa5ce MD5 hash Sakula malware
              67112866e800b9dce2892cf827444d60 MD5 hash Sakula malware
              67fceab90a142e1e286bca0922dbffd3 MD5 hash Sakula malware
              68e13422b9a5d280f4a19235d8bf7da5 MD5 hash Sakula malware
              69314300da7a4a0e95be545b804565dd MD5 hash Sakula installer
              6a2ea24ed959ef96d270af5cdc2f70a7 MD5 hash Sakula malware
              6bd7fb8f4565866ff032f236f0a29ee2 MD5 hash Sakula malware
              6ccb6d1b964f115f8c7215c6ab67b1cc MD5 hash Sakula malware
              740561c8d5d2c658d2134d5107802a9d MD5 hash Sakula installer
              74eb66027ac6fa5a59632383e09915e2 MD5 hash Sakula malware
              7b2677c7215fab4e42f4507eb01c4326 MD5 hash XOR-encoded Sakula malware
              81d74b0e9560f2bf780f12893d885f41 MD5 hash Sakula malware
              848fcb062218ae3162d07665874429a7 MD5 hash Sakula malware
              8506064925a774a8d11d9fac374eb86a MD5 hash Sakula malware
              8542cf0d32b7c711d92089a7d442333e MD5 hash Sakula malware
              888876810fa9f85a82645bf5d16468e8 MD5 hash Sakula installer
              8a45ea989807636cc685b81effc60d96 MD5 hash Sakula malware
              8ee244ad6b6f2b814d34d26dae880f12 MD5 hash Sakula malware
              8f523f7fc73e52d54bb4e94dc44768b0 MD5 hash Sakula malware
              91569c57fc342161c479603f3b527c1d MD5 hash Sakula malware
              928579b6fd1162c3831075a7a78e3f47 MD5 hash Sakula malware
              96fab28f1539f3909a255436bc269062 MD5 hash Sakula malware
              98721c78dfbf8a45d152a888c804427c MD5 hash Sakula installer
              9a63f72911b385a0c17427444c968ed0 MD5 hash Sakula installer
              9e45ad7f3f3354ff99b979b9dfe54248 MD5 hash Sakula malware
              9f38fbcc039e0b42e56eb79315a39ee9 MD5 hash Sakula malware
              a00a19c85c42cb49ad48c0be349daec0 MD5 hash Sakula malware
              a00e275feb97b55776c186579d17a218 MD5 hash Sakula malware
              a034a674b439d9b3d3ad1718bc0c6bb0 MD5 hash Sakula malware
              a05fb3920fe3842623f55df712914916 MD5 hash Sakula malware
              a068bf4b31738a08ed06924c7bf37223 MD5 hash Sakula malware
              a104ab14c9a1d425a0e959f046c97f29 MD5 hash Sakula malware
              a2030658767635894abdb3742db5e279 MD5 hash Sakula malware
              a225ee8669c52540b5056fd848f1e267 MD5 hash Sakula malware
              a2bdb2aaf4d8eacbbb634476f553455b MD5 hash Sakula malware
              a33c6daba951f7c9a30d69b5e1e58af9 MD5 hash Sakula malware
              a39729153ceaeaf9b3aded9a28d0e4dc MD5 hash Sakula malware
              a53782f0790258d7ae1c9330b4106976 MD5 hash Sakula malware
              a548d3dedd85683930d9732ed0316ec0 MD5 hash Sakula malware
              a700db7a97eceea15d5f43d1376a6f09 MD5 hash Sakula malware
              a759b73716bdc406b9a20ebef394bc6d MD5 hash Sakula malware
              a7e467e16834e80a5713e0d6bb73def5 MD5 hash Sakula malware
              a932a0d01962773e2a8f4a516c5d0515 MD5 hash Sakula installer
              ab557f2197647aa3fb7be3de8770a109 MD5 hash Sakula malware
              aca2756917024c859d1f13ca1cdcb843 MD5 hash Sakula malware
              ae6f33f6cdc25dc4bda24b2bccff79fe MD5 hash Sakula malware
              aec367555524a71efcc60f45e476c678 MD5 hash Sakula malware
              b011a616da408875bd0d39cebf11dd1d MD5 hash Sakula malware
              b297c84e2cdeacdbae86cbf707fc7540 MD5 hash Sakula malware
              b2d900e2803dd0bcd5e85b64e24c7910 MD5 hash Sakula malware
              b42417f49dd3aa2d31449fdf06769ca0 MD5 hash Sakula malware
              b4958424c5db8b0eca61ce836b81d192 MD5 hash Sakula malware
              b4e24a4edba2d2644877cfc933973228 MD5 hash Sakula malware
              b6d9a58bacb8a92e428f7d70532cb33e MD5 hash Sakula malware
              b79be0503606ee3e2ce243e497265dbb MD5 hash Sakula malware
              b7bd80dd344af7649b4fd6e9b7b5fd5c MD5 hash Sakula malware
              b7e3f853e98ea9db74bf3429803f7a4b MD5 hash Sakula malware
              b8006fde97a095b2c86f8b0a06b7d24f MD5 hash Sakula malware
              b83fed01e49300d45afadc61a5e5cf50 MD5 hash Sakula malware
              bb4bb0d7a794f31129cdb55025ea847b MD5 hash Sakula malware
              bc74a557e91597d8b37ed357c367643e MD5 hash Sakula malware
              bc99d3f41dfca74f2b40ce4d4f959af0 MD5 hash Sakula command component
              bccaa2ea0cf2c8ef597c84726c5417d0 MD5 hash Sakula malware
              bddb68ea6c732613bc4a31503eac3297 MD5 hash Sakula malware
              beb174ca92c75c8ef4dc4ee24afeabeb MD5 hash Sakula malware
              bf29d2c64db69170ae01ebb4eabe9bd3 MD5 hash Sakula installer
              c0e37ffac09a426c5a74167d0e714177 MD5 hash Sakula malware
              c1f09f902a24b5132be481d477b92e5e MD5 hash Sakula malware
              c2b7bf8a30ac6672d9eb81582bd32a4a MD5 hash Sakula malware
              c35300af4a2b23c1a7d6435c6d4cb987 MD5 hash Sakula malware
              c384e7f567abd9ea50f647715a28661a MD5 hash Sakula installer
              c43d74b85001f622aad61e9da5744b52 MD5 hash Sakula malware
              c4f541ab592c8fca4d66235eb2b8eeb2 MD5 hash Sakula malware
              c50612ebe76bfd7bc61174c581fb2a95 MD5 hash Sakula installer
              c5e90ead14dc49449fa37a2869a45842 MD5 hash Sakula malware
              c71b09dfffd870af2c38a8135762e84d MD5 hash Sakula installer
              c72fb5b8de6ee95ff509b161fe9828f3 MD5 hash Sakula malware
              c823946a7490b8fc5ee29be583f39d23 MD5 hash Sakula malware
              c83500ea6e0c9844ad2e21badb64bb23 MD5 hash Sakula malware
              c869c75ed1998294af3c676bdbd56851 MD5 hash Sakula installer
              c8fa5701a43cd817b30327e44dc70369 MD5 hash Sakula malware
              ca9e06c0679586d2ff3ff7e3416c8b87 MD5 hash Sakula malware
              cb56b1fc08451d1f56481a29bd1047e9 MD5 hash Sakula malware
              cc15a9109b41297f65a7349920f42c09 MD5 hash Sakula malware
              ce09e671c124f1111fe5f2bde1267a63 MD5 hash Sakula malware
              cec76eec323613641dce1a261ca9a850 MD5 hash Sakula malware
              d00b3169f45e74bb22a1cd684341b14a MD5 hash Sakula malware
              d690ba5dbb873c469cfdaf44fe2bd67f MD5 hash Sakula malware
              d76be14a5e3a6ec45150ad2582f5c1a8 MD5 hash Sakula installer
              d86a4148bd34d78b808fdee7f936f1af MD5 hash Sakula malware
              d87ce47e24ee426d8ac271873b041d50 MD5 hash Sakula malware
              d8b496c4837b80952c52e1375c31648c MD5 hash Sakula malware
              dba4e180ed355a4ad63ceaf57447b2b7 MD5 hash Sakula installer
              dda9f3b2d5e70e70be1be7e4195b7016 MD5 hash Sakula malware
              df689186b50384026382d5179841abec MD5 hash Sakula malware
              e2c32ed6b9cd40cb87569b769db669b7 MD5 hash Sakula malware
              e595292b1cdaea69ef365097a36195ad MD5 hash Sakula malware
              e604176c2638fdf015d6a346803ed6f3 MD5 hash Sakula malware
              e66164b4967cf7b3cdb3c1c510abe957 MD5 hash Sakula malware
              e7113c872386edd441e7030d185238ca MD5 hash Sakula malware
              e9115f553ac156542dcd38042f45ec68 MD5 hash Sakula malware
              e9181ef132fec9e560822551a093bb5c MD5 hash Sakula malware
              f0082c886bc04fafe4a2615d75c2eaeb MD5 hash Sakula malware
              f06b0ee07daa7f914dec27f98a6d8850 MD5 hash Sakula malware
              f2d59757a9795531796df91097d5fa2b MD5 hash Sakula malware
              f47afcbc291cbc108112c110de77dbb1 MD5 hash Sakula malware
              f583a1fdb3c8be409e2118795ad916ba MD5 hash Sakula malware
              f60f94d257ad5d781595b6c909844422 MD5 hash Sakula malware
              fbb2db8a78645f0a2e0f34316f119144 MD5 hash Sakula malware
              fbd85dad36fe13d46eaca7d7f2d50b0b MD5 hash Sakula malware
              fc52814e8eb48aca6b87fa43656cbf42 MD5 hash Sakula malware
              fe74dc43af839146f64ec7bea752c4f0 MD5 hash Sakula malware
              fedf54586ebd00684e20712ad7eb9189 MD5 hash Sakula malware
              019a5f531f324d5528ccc09faa617f42 MD5 hash Sakula malware
              01c45a203526978a7d8d0457594fafbf MD5 hash Sakula malware
              023ef99bc3c84b8df3f837454c0e1629 MD5 hash Sakula malware
              0334b1043c62d48525a29aeb95afcb09 MD5 hash Sakula malware
              04e8510007eea6bb009ab3b053f039db MD5 hash Sakula malware
              05cd4bfeac3ad6144b5f5023277afa45 MD5 hash Sakula malware
              06ec79f67ad8ede9a3bd0810d88e3539 MD5 hash Sakula malware
              07b678ed364b23688b02a13727166a45 MD5 hash Sakula malware
              0a2c6265a65a25e9bef80f55cdd62229 MD5 hash Sakula malware
              0d0f5c0416247bb1dd6e0e2be1114b67 MD5 hash Sakula malware
              1077a39788e88dbf07c0b6ef3f143fd4 MD5 hash Sakula malware
              116dbfd8f5b6c5a5522d3b83a3821268 MD5 hash Sakula malware
              121320414d091508ac397044495d0d9c MD5 hash Sakula malware
              1371181a6e6852f52374b4515aaa026a MD5 hash Sakula malware
              1472fffe307ad13669420021f9a2c722 MD5 hash Sakula malware
              1856a6a28621f241698e4e4287cba7c9 MD5 hash Sakula malware
              1b826fa3fd70a529623ed1267944cee5 MD5 hash Sakula malware
              1bb0fb051cf5ba8772ad8a21616f1edb MD5 hash Sakula malware
              1ff57a7aa2aa92698356f6c157290a28 MD5 hash Sakula malware
              21131bce815f2cb1bc0eb1fbf00b3c25 MD5 hash Sakula malware
              21ee6c85f431c2aa085b91ac0c86d27f MD5 hash Sakula malware
              23169a0a2eee3d12fde0f3efd2cd55f1 MD5 hash Sakula malware
              231d0bfe48388082f5769f3deef5bcab MD5 hash Sakula malware
              2414d83e97cb4c442b5594c6fbafe045 MD5 hash Sakula malware
              260349f5343244c439b211d9f9ff53cf MD5 hash Sakula malware
              276f06196001dcfa97a035509f0cd0aa MD5 hash Sakula malware
              29bd6cfc21250dfa348597a21a4a012b MD5 hash Sakula malware
              2adc305f890f51bd97edbece913abc33 MD5 hash Sakula malware
              2ca3f59590a5aeab648f292bf19f4a5e MD5 hash Sakula malware
              2f23af251b8535e24614c11d706197c3 MD5 hash Sakula malware
              2ff61b170821191c99d8b75bd01726f2 MD5 hash Sakula malware
              33be8e41a8c3a9203829615ae26a5b6e MD5 hash Sakula malware
              34b7aa103deefbe906df59106683cc97 MD5 hash Sakula malware
              3859b0ea4596d8f47677497d09bcc894 MD5 hash Sakula malware
              3a1df1ec3ef499bb59f07845e7621155 MD5 hash Sakula malware
              3edbc66089be594233391d4f34ec1f94 MD5 hash Sakula malware
              3ff30fce107a01d3d17a9768abe6e086 MD5 hash Sakula malware
              416e598fb1ed9a7b6ce815a224015cb8 MD5 hash Sakula malware
              416e831d583665352fe16fe9232d36cf MD5 hash Sakula malware
              421bff8f5dd218727283a2914424eccc MD5 hash Sakula malware
              43e6a46d8789e1563e94ff17eff486d7 MD5 hash Sakula malware
              470e8dd406407b50483ce40de46660af MD5 hash Sakula malware
              488c55d9a13c7fa8ee1aa0c15a43ab1e MD5 hash Sakula malware
              492c59bddbcbe7cbd2f932655181fb08 MD5 hash Sakula malware
              4d8482da8730a886e4d21c5bfb7cd30e MD5 hash Sakula malware
              4e239b731a0f1dbf26b503d5e2a81514 MD5 hash Sakula malware
              501db97a6b60512612909cfe959fbcd0 MD5 hash Sakula malware
              5496cff5e3bf46448c74fbe728763325 MD5 hash Sakula malware
              55daa4271973bb71ad4548225675e389 MD5 hash Sakula malware
              567a33e09af45123678042e620f31769 MD5 hash Sakula malware
              5a843bc0b9f4525b1ee512e1eba95641 MD5 hash Sakula malware
              5a894c18c5cc153f80699145edd1c206 MD5 hash Sakula malware
              5b76c68f9ca61bfd8a5bcbf2817a1437 MD5 hash Sakula malware
              5bb780344a601f4eff9ce0c55daf4361 MD5 hash Sakula malware
              5eea7686abeba0affa7efce4da31f277 MD5 hash Sakula malware
              5ff5916c9f7c593d1d589c97c571b45a MD5 hash Sakula malware
              617eda7bcba4e3d5acc17663bbc964b3 MD5 hash Sakula malware
              62d4777dd8953743d26510f00b74f444 MD5 hash Sakula malware
              62e82c46647d2d2fe946791b61b72a4d MD5 hash Sakula malware
              638304bf859e7be2f0fa39a655fdaffc MD5 hash Sakula malware
              63f171705b28a05c84b67750b7e0ebf7 MD5 hash Sakula malware
              69374e5bcb38a82ef60c97ec0569ded3 MD5 hash Sakula malware
              6a273afa0f22d83f97d9fd2dc7dce367 MD5 hash Sakula malware
              6a7b2feed82d8d1746ac78df5a429bce MD5 hash Sakula malware
              6bdf4e5b35b4cc5d3d519edc67086d7f MD5 hash Sakula malware
              6c3523020a2ba0b7045060707d8833ea MD5 hash Sakula malware
              6c4d61fedd83970cf48ef7fdd2a9871b MD5 hash Sakula malware
              6d308fc42618812073481df1cd0452a7 MD5 hash Sakula malware
              71bbd661a61e0fee1f248f303af06f3f MD5 hash Sakula malware
              7248d4b73d68cfc023d8d156c63f6b74 MD5 hash Sakula malware
              77a25486d425825986d2c6306a61f637 MD5 hash Sakula malware
              7d2c9936bff1e716b8758376cd09505d MD5 hash Sakula malware
              7ee7a9446d7cf886223274d809d375d6 MD5 hash Sakula malware
              80eb86542ce7ad99acc53a9f85b01885 MD5 hash Sakula malware
              836a618341c6149e7c83e99755a7fd5f MD5 hash Sakula malware
              895dc0a3adfafce2a74d733ff2a8754e MD5 hash Sakula malware
              8b3de46ecb113cd1ee2d9ec46527358f MD5 hash Sakula malware
              8b52cd1df70ef315bce38223ac7f4ec3 MD5 hash Sakula malware
              8feb7d6eae0ab9c1900fb6d0b236201b MD5 hash Sakula malware
              90bc832fbaa6bbd7e4251c39473e5a4b MD5 hash Sakula malware
              930af711a1579f3e1326cdb6d0005398 MD5 hash Sakula malware
              9526e4abcacc4e4a55fa1b2fc2313123 MD5 hash Sakula malware
              97479fa13d9b96da33cdb49749fc2baf MD5 hash Sakula malware
              97a6e9e93bc591baf588bada61559d6a MD5 hash Sakula malware
              97fc2d9b514f3183ae7c800408e5c453 MD5 hash Sakula malware
              985e819294cdc3b5561c5befa4bcbc5b MD5 hash Sakula malware
              9c4db94cc3bdb9b5864bde553bff1224 MD5 hash Sakula malware
              9cee5c49dcaad59ea0eea6e7b67c304c MD5 hash Sakula malware
              a006d31515bb2a54b5c3ddda8d66f24b MD5 hash Sakula malware
              a05bc6c5f63880b565941ac5c5933bfe MD5 hash Sakula malware
              a1a15a9e82880e8fc881668c70126315 MD5 hash Sakula malware
              a39c424e6df5d10b74aa72fb3a120c0c MD5 hash Sakula malware
              a4856f40fd013b6144db8fe19625434b MD5 hash Sakula malware
              a554e8867a076768e57e923a249f7a09 MD5 hash Sakula malware
              a81569d86c4a7bce2c446f169816a7ff MD5 hash Sakula malware
              a90e38c3214eeba99aa46ad5e3ec34ff MD5 hash Sakula malware
              a91ba2ab82553f43440ed24a9afeef82 MD5 hash Sakula malware
              ab357c26a2ed7379b62dd1cc869690b7 MD5 hash Sakula malware
              ab8badbf16a0cd7013197977f8b667e9 MD5 hash Sakula malware
              ab91b9e35d2b1e56285c042eef95d324 MD5 hash Sakula malware
              ae55d7b5c3d3bc7ed338d40ada25902f MD5 hash Sakula malware
              aeed29398ceb645213cf639a9f80367c MD5 hash Sakula malware
              af114e711259964b1db0235e9b39a476 MD5 hash Sakula malware
              af661cb478510d1d00dfdf1f2de4e817 MD5 hash Sakula malware
              b31e97c9740d8e95e56a5957777830d7 MD5 hash Sakula malware
              b38c4766ec0c5fb9b9e70af0b7414e78 MD5 hash Sakula malware
              b6b3e7b18384bb632602662a7f559bcd MD5 hash Sakula malware
              b8346b4a5f8b4a6d79814f9824940504 MD5 hash Sakula malware
              ba5415f34927a356d4aaffb4bd7fe907 MD5 hash Sakula malware
              bb57362757182b928d66d4963104ffe8 MD5 hash Sakula malware
              bd48ca50da3b76aa497f28d842954c12 MD5 hash Sakula malware
              bdb6a8a95e5af85d8b36d73ba33ec691 MD5 hash Sakula malware
              bf35690e72a3fbd66ff721bd14a6599e MD5 hash Sakula malware
              c5933a7ca469e98f7799c3ab52a1bc3c MD5 hash Sakula malware
              c66b335fb606b542206b5a321beb2a76 MD5 hash Sakula malware
              c6d1954b58a17bd203e7b6be9d5047d8 MD5 hash Sakula malware
              c6eab24761a223e6c6f1a9d15ecca08a MD5 hash Sakula malware
              cd1c95aa6f45101735d444aeb447225c MD5 hash Sakula malware
              cfd1eb4ccdeea554d8cffa17021ffbfa MD5 hash Sakula malware
              d1f0ff695021aed31ada3397ad1f491e MD5 hash Sakula malware
              d2a27b9acb8dc9a9adbde76d2a10a189 MD5 hash Sakula malware
              d3cb441f03e8370155381d74c2b7d827 MD5 hash Sakula malware
              d57075de72308ed72d8f7e1af9ce8431 MD5 hash Sakula malware
              d5d6881b4bef3544d9067b71af3287eb MD5 hash Sakula malware
              d7351f6937379dbbeedc83d37a86e794 MD5 hash Sakula malware
              d810b773e694279ece31106c26fb2869 MD5 hash Sakula malware
              d82230d1ac02405d16530f849abdde0b MD5 hash Sakula malware
              d875a70c4b07dcc18770870c9c1d2abd MD5 hash Sakula malware
              dc7469f6b18cfce712156e3988d238d2 MD5 hash Sakula malware
              df15e0f3169f65080ee7d783c061cda3 MD5 hash Sakula malware
              dfea1e69d2f5d84a1b6c6b67b01b7ff8 MD5 hash Sakula malware
              e0b6a8e23e0d586663e74f1e1d755ae0 MD5 hash Sakula malware
              e13bf40bbdbba86d638c04e0d72de268 MD5 hash Sakula malware
              e1b53ff413915e03245807b2eba504eb MD5 hash Sakula malware
              e1ccd9f1696e4bf943fa2816356a443b MD5 hash Sakula malware
              e36028a1bf428bb5a0993dc445deb5b8 MD5 hash Sakula malware
              e7139a2e1e28efd6c303dc28f676ffe3 MD5 hash Sakula malware
              e804f5d88ceb937b6ce0c900260793d3 MD5 hash Sakula malware
              ec85830342217b5d03f6bd26a703ce1a MD5 hash Sakula malware
              ef855c88842821a15a80bbee00024817 MD5 hash Sakula malware
              ef94e4b0bd689972df09e19a3ed0653e MD5 hash Sakula malware
              f1eb2a68d5d438e93a22b2126c812f4d MD5 hash Sakula malware
              f349ee3706c815a79a60d2534284935d MD5 hash Sakula malware
              f4862b793f89b9ca59da6ac38dff0e2d MD5 hash Sakula malware
              f5b9862f2d508c57b81fbaaad91030f4 MD5 hash Sakula malware
              f8dbcfe4f826aa27724ccfd6b080b26d MD5 hash Sakula malware
              f918fc73484f2a1684de53040ec816d2 MD5 hash Sakula malware
              f942344daf85bf211b4a27a1c947843c MD5 hash Sakula malware
              f9b71e959f79d25bad195f59f5ae502e MD5 hash Sakula malware
              faed2bcd842e81c180a6ac9dde78f8d5 MD5 hash Sakula malware
              fcad5bdeb3eb2eaa6e1c2bb9d9eb2cc0 MD5 hash Sakula malware
              fd69439c6e2bac79e490b9572b6c91ad MD5 hash Sakula malware
              ff1d5c6a476a56eb7ca4e38b57761a4e MD5 hash Sakula malware

              Table 6. Threat indicators for Sakula.

              Related Content