1. Home
  2. Software
  3. Sakula

Sakula

Sakula is a remote access tool (RAT) that first surfaced in 2012 and was used in intrusions throughout 2015. [1]

ID: S0074
ⓘ
Associated Software: Sakurel, VIPER
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.2
Created: 31 May 2017
Last Modified: 11 April 2024
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1543 .003 创建或修改系统进程: Windows Service

Some Sakula samples install themselves as services for persistence by calling WinExec with the net start argument.[1]
Enterprise T1573 .001 加密通道: Symmetric Cryptography

Sakula encodes C2 traffic with single-byte XOR keys.[1]
Enterprise T1574 .002 劫持执行流: DLL Side-Loading

Sakula uses DLL side-loading, typically using a digitally signed sample of Kaspersky Anti-Virus (AV) 6.0 for Windows Workstations or McAfee's Outlook Scan About Box to load malicious DLL files.[1]
Enterprise T1547 .001 启动或登录自动启动执行: Registry Run Keys / Startup Folder

Most Sakula samples maintain persistence by setting the Registry Run key SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ in the HKLM or HKCU hive, with the Registry value and file name varying by sample.[1]
Enterprise T1059 .003 命令与脚本解释器: Windows Command Shell

Sakula calls cmd.exe to run various DLL files via rundll32 and also to perform file cleanup. Sakula also has the capability to invoke a reverse shell.[1]
Enterprise T1071 .001 应用层协议: Web Protocols

Sakula uses HTTP for C2.[1]
Enterprise T1027 .013 混淆文件或信息: Encrypted/Encoded File

Sakula uses single-byte XOR obfuscation to obfuscate many of its files.[1]
Enterprise T1548 .002 滥用权限提升控制机制: Bypass User Account Control

Sakula contains UAC bypass code for both 32- and 64-bit systems.[1]
Enterprise T1070 .004 移除指标: File Deletion

Some Sakula samples use cmd.exe to delete temporary files.[1]
Enterprise T1218 .011 系统二进制代理执行: Rundll32

Sakula calls cmd.exe to run various DLL files via rundll32.[1]
Enterprise T1105 输入工具传输

Sakula has the capability to download files.[1]

Groups That Use This Software

ID Name References
G0009 Deep Panda

[2]

References

  1. Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, July 30). Sakula Malware Family. Retrieved January 26, 2016.
  1. ThreatConnect Research Team. (2015, February 27). The Anthem Hack: All Roads Lead to China. Retrieved January 26, 2016.