1. Home
  2. Software
  3. Sakula

Sakula

Sakula is a remote access tool (RAT) that first surfaced in 2012 and was used in intrusions throughout 2015. [1]

ID: S0074
ⓘ
Associated Software: Sakurel, VIPER
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.1
Created: 31 May 2017
Last Modified: 30 March 2020
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1548 .002 Abuse Elevation Control Mechanism: Bypass User Account Control

Sakula contains UAC bypass code for both 32- and 64-bit systems.[1]
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

Sakula uses HTTP for C2.[1]
Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Most Sakula samples maintain persistence by setting the Registry Run key SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ in the HKLM or HKCU hive, with the Registry value and file name varying by sample.[1]
Enterprise T1059 .003 Command and Scripting Interpreter: Windows Command Shell

Sakula calls cmd.exe to run various DLL files via rundll32 and also to perform file cleanup. Sakula also has the capability to invoke a reverse shell.[1]
Enterprise T1543 .003 Create or Modify System Process: Windows Service

Some Sakula samples install themselves as services for persistence by calling WinExec with the net start argument.[1]
Enterprise T1573 .001 Encrypted Channel: Symmetric Cryptography

Sakula encodes C2 traffic with single-byte XOR keys.[1]
Enterprise T1574 .002 Hijack Execution Flow: DLL Side-Loading

Sakula uses DLL side-loading, typically using a digitally signed sample of Kaspersky Anti-Virus (AV) 6.0 for Windows Workstations or McAfee's Outlook Scan About Box to load malicious DLL files.[1]
Enterprise T1070 .004 Indicator Removal on Host: File Deletion

Some Sakula samples use cmd.exe to delete temporary files.[1]
Enterprise T1105 Ingress Tool Transfer

Sakula has the capability to download files.[1]
Enterprise T1027 Obfuscated Files or Information

Sakula uses single-byte XOR obfuscation to obfuscate many of its files.[1]
Enterprise T1218 .011 Signed Binary Proxy Execution: Rundll32

Sakula calls cmd.exe to run various DLL files via rundll32.[1]

Groups That Use This Software

ID Name References
G0009 Deep Panda

[2]

References

  1. Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, July 30). Sakula Malware Family. Retrieved January 26, 2016.
  1. ThreatConnect Research Team. (2015, February 27). The Anthem Hack: All Roads Lead to China. Retrieved January 26, 2016.