Loading malware…
Sakula, also known as Sakurel and VIPER, is a Windows remote access trojan associated with targeted intrusions attributed to Chinese threat activity, including reporting linking it to Deep Panda and to intrusions referenced in U.S. indictments involving Chinese operators. It was active in observed operations from at least 2012 through 2015 and was notably associated with strategic web compromise activity exploiting CVE-2014-0322 as well as installer-based delivery masquerading as legitimate software.
Sakula provides interactive remote access and post-compromise control, including remote shell capability, file upload and download, execution of additional payloads, and general command execution. It communicates with command-and-control infrastructure over HTTP using GET and POST requests and obfuscates traffic, embedded strings, and stored resources with single-byte XOR encoding. Samples have also been observed invoking cmd.exe and rundll32 during execution and cleanup.
A defining tradecraft feature of Sakula is DLL side-loading. Multiple variants abuse legitimate signed Windows applications and third-party software components to load malicious DLLs, including known use of signed Kaspersky and McAfee components. This technique supports defense evasion and execution while blending into trusted software activity. Some variants also include User Account Control bypass code for both 32-bit and 64-bit Windows systems, indicating support for privilege escalation during installation or follow-on execution.
Persistence is commonly achieved through Windows Registry Run entries, while some samples install themselves as Windows services. Certain variants perform cleanup by deleting temporary artifacts after installation. The malware’s code base remained relatively stable across multiple years of observed use, suggesting it was an effective and reusable espionage platform for targeted operations against organizations in multiple sectors.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CTU researchers observed a copy of Sakula being delivered in a strategic web compromise (SWC) that exploited CVE-2014-0322, which was a zero-day vulnerability in Internet Explorer at the time of compromise. | Dell SecureWorks Counter Threat Unit researchers analyzed multiple versions of a remote access trojan (RAT) named Sakula (also known as Sakurel and VIPER).
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The indictment was filed by US federal attorneys... it accuses ten Chinese individuals... According to the indictment... they used the Sakula, PlugX, and Winnti malware in the different organizations.
Matt Dahl, “I am Ironman: DEEP PANDA Uses Sakula Malware to Target Organizations in Multiple Sectors,” CrowdStrike, November 24, 2014
23 distinct techniques documented for this family, organized by ATT&CK tactic.
Numerous entries state malware can create a remote shell or reverse shell, for example 4H RAT, BLACKCOFFEE, DarkComet, PlugX, QuasarRAT, and others. | The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.
In a small group of Sakula samples from 2013, the install process also modified the hosts file to point some of the victim's subdomains to various IP addresses within the victim's own organization. The malware also registered a file as a command component within the registry.
In the cases where Sakula does not use a registry key for persistence, it attempts to set itself up as a service.
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
The malware reportedly utilizes techniques similar to those observed in previous RAT families, including process injection, reflective DLL injection, and single-byte XOR encoding to obfuscate network communications and embedded strings, making detection significantly more difficult for security solutions.
In the cases where Sakula does not use a registry key for persistence, it attempts to set itself up as a service.
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
The content repeatedly describes malware and threat actors that 'bypass UAC,' 'perform UAC bypass,' or use specific Windows components such as fodhelper.exe, eventvwr.exe, sdclt.exe, CMSTPLUA COM interface, SilentCleanup, and registry hijacks to gain elevated privileges.
Network communication is obfuscated with single-byte XOR encoding. Sakula also leverages single-byte XOR encoding to obfuscate various strings and files embedded in the resource section...
Some installers masqueraded as the following applications and used social engineering to convince users that the applications were required to do business: Adobe Self Extractor, CITRIX Access Gateway Secure Input, Juniper SSL VPN ActiveX Plugin, Microsoft Hotfix Security Exchange Mail, Exchange ActiveX Control.
The malware reportedly utilizes techniques similar to those observed in previous RAT families, including process injection, reflective DLL injection, and single-byte XOR encoding to obfuscate network communications and embedded strings, making detection significantly more difficult for security solutions.
The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.
The legitimate application is a digitally signed sample of Kaspersky Anti-Virus (AV) 6.0 for Windows Workstations. When the Kaspersky application is run, it loads a file named msi.dll, which is located within the same directory.
HKU\Software\Microsoft\Windows\CurrentVersion\Run\MicroWhoknow: "mshta vbscript:CreateObject("WScript.Shell").Run("cmd /c cd C:\Users\user\AppData\Local\Temp\MicroWhoknow && rundll32 MicroWhoknow.dll Plugupdate",0)(window.close)"
Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.
In a small group of Sakula samples from 2013, the install process also modified the hosts file to point some of the victim's subdomains to various IP addresses within the victim's own organization. The malware also registered a file as a command component within the registry.
Many entries describe XOR, XOR/ADD, bitwise NOT and XOR, ROR plus XOR, hexadecimal encoding after encryption, and custom encoding/obfuscation of HTTP traffic or beacons.
Threat actors and malware developers utilise TLS certificates to encrypt communications and establish connections between a target host and malicious infrastructure.
The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.
31 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
29 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan used in targeted intrusions from at least 2012 through 2015. It provides interactive command execution, file upload/download and execution, persistence via Run keys or services, UAC bypass, DLL side-loading, and HTTP GET/POST C2 communications obfuscated with single-byte XOR encoding.
Command-and-control tooling listed among sightings tied to the ASN discussed in the report.
Previously documented malware family referenced for similarity in command-and-control behavior, specifically use of HTTP GET and POST requests for C2 communications.
Malware tracked via TLS certificate issuer/subject fields with a consistent eight-character lowercase alphanumeric structure suitable for regex-based hunting.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.