Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
RAT

Sakula

RAT Needs review 36 detections found
This entry hasn't been reviewed yet. It was auto-detected from the MITRE ATT&CK catalog because it self-identifies as rat-type malware, but no one has curated a full summary or double-checked its reference links. Treat the details below as a starting point, not a verified profile.

Also known as: Sakula, Sakurel, VIPER

Auto-detected from the MITRE ATT&CK catalog on 2026-09-28 (S0074) - this entry has not been reviewed or curated yet. See the MITRE ATT&CK link below for what's currently known; a proper summary and authoritative eradication references are pending.

Detection & eradication references

Curated links to authoritative sources — MITRE ATT&CK, CISA advisories, law-enforcement takedown announcements, and vendor threat-intel writeups — for removal, remediation, and further technical detail. Sigma Watch does not publish its own removal steps here, since malware behavior and tooling change too fast for a static write-up to stay reliably accurate.

Detection rules

Source Rule Status Updated
suricata ET MALWARE Sakula/Mivast C2 Activity rev 6 2024-05-01
suricata ET MALWARE Arid Viper APT Exfiltrating files rev 6 2024-05-01
suricata ET MALWARE Likely Arid Viper APT Advtravel Campaign POST rev 8 2024-04-30
suricata ET MALWARE Likely Arid Viper APT Advtravel Campaign GET Keepalive rev 10 2024-04-30
suricata ET MALWARE Sakula/Mivast RAT CnC Beacon 2 rev 6 2024-04-28
suricata ET MALWARE Sakula/Mivast RAT CnC Beacon 3 rev 6 2024-04-28
suricata ET MALWARE Sakula/Mivast RAT CnC Beacon 6 rev 6 2024-04-28
suricata ET MALWARE Sakula/Mivast RAT CnC Beacon 7 rev 7 2024-04-28
suricata ET MALWARE Arid Viper APT Checkin 2 rev 5 2024-04-21
suricata ET MALWARE Arid Viper APT Checkin 1 rev 5 2024-04-21
suricata ET MALWARE Arid Viper APT File information rev 5 2024-04-21
suricata ET MALWARE Arid Viper APT Transmitting Date rev 5 2024-04-21
suricata ET MALWARE Arid Viper APT Checking filename rev 5 2024-04-21
suricata ET MALWARE Arid Viper APT Transmitting Serial rev 5 2024-04-21
suricata ET MALWARE Sakula/Mivast RAT CnC Beacon 1 rev 7 2024-04-20
snort ET TROJAN Sakula/Mivast RAT CnC Beacon 7 rev 2 2015-08-01
snort ET TROJAN Sakula/Mivast RAT CnC Beacon 6 rev 1 2015-08-01
snort ET TROJAN Sakula/Mivast RAT CnC Beacon 3 rev 1 2015-06-08
snort ET TROJAN Sakula/Mivast RAT CnC Beacon 2 rev 1 2015-06-08
snort ET TROJAN Sakula/Mivast RAT CnC Beacon 1 rev 4 2015-06-08
snort ET TROJAN Likely Arid Viper APT Advtravel Campaign GET Keepalive rev 4 2015-02-20
snort ET TROJAN Likely Arid Viper APT Advtravel Campaign POST rev 4 2015-02-20
snort ET TROJAN Arid Viper APT Checking filename rev 1 2015-02-17
snort ET TROJAN Arid Viper APT Checkin 1 rev 1 2015-02-17
snort ET TROJAN Arid Viper APT Transmitting Date rev 1 2015-02-17
snort ET TROJAN Arid Viper APT Exfiltrating files rev 1 2015-02-17
snort ET TROJAN Arid Viper APT Transmitting Serial rev 1 2015-02-17
snort ET TROJAN Arid Viper APT File information rev 1 2015-02-17
snort ET TROJAN Arid Viper APT Checkin 2 rev 1 2015-02-17
snort ET TROJAN Sakula/Mivast C2 Activity rev 1 2015-02-06
yara Sakurel_backdoor — —
yara sakula_v1_3 — —
yara sakula_v1_4 — —
yara sakula_v1_1 — —
yara sakula_v1_0 — —
yara sakula_v1_2 — —