Sakula
Sakula is a remote access tool (RAT) that first surfaced in 2012 and was used in intrusions throughout 2015. [1]
ID: S0074
Aliases: Sakula, Sakurel, VIPER
Type: MALWARE
Platforms: Windows
Version: 1.0
Techniques Used
| Domain | ID | Name | Use |
|---|---|---|---|
| Enterprise | T1088 | Bypass User Account Control | Sakula contains UAC bypass code for both 32- and 64-bit systems.[1] |
| Enterprise | T1059 | Command-Line Interface | Sakula calls cmd.exe to run various DLL files via rundll32 and also to perform file cleanup. Sakula also has the capability to invoke a reverse shell.[1] |
| Enterprise | T1024 | Custom Cryptographic Protocol | Sakula encodes C2 traffic with single-byte XOR keys.[1] |
| Enterprise | T1073 | DLL Side-Loading | Sakula uses DLL side-loading, typically using a digitally signed sample of Kaspersky Anti-Virus (AV) 6.0 for Windows Workstations or McAfee's Outlook Scan About Box to load malicious DLL files.[1] |
| Enterprise | T1107 | File Deletion | Some Sakula samples use cmd.exe to delete temporary files.[1] |
| Enterprise | T1050 | New Service | Some Sakula samples install themselves as services for persistence by calling WinExec with the net start argument.[1] |
| Enterprise | T1027 | Obfuscated Files or Information | Sakula uses single-byte XOR obfuscation to obfuscate many of its files.[1] |
| Enterprise | T1060 | Registry Run Keys / Startup Folder | Most Sakula samples maintain persistence by setting the Registry Run key SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ in the HKLM or HKCU hive, with the Registry value and file name varying by sample.[1] |
| Enterprise | T1105 | Remote File Copy | Sakula has the capability to download files.[1] |
| Enterprise | T1085 | Rundll32 | Sakula calls cmd.exe to run various DLL files via rundll32.[1] |
| Enterprise | T1071 | Standard Application Layer Protocol | Sakula uses HTTP for C2.[1] |
Groups
Groups that use this software:
Deep Panda