Trusted Design

#1020 Dissecting the Malware Involved in the INOCNATION Campaign

概要

Last month, CrowdStrike published a blog on malware campaigns attributed to Sakula. We took a look at the malware specifically in the INOCNATION campaign to analyze what was new and different about the techniques used by the threat actor. It appears the entity behind this campaign took steps to make reverse engineering more difficult and chose the use of Cisco’s AnyConnect Client as a lure to trick victims into installing the malware. The RAT delivered by this campaign was not particularly interesting and had all the features you would expect in such a tool. The use of the obfuscation techniques was novel and this advisory discusses those in detail, along with how we detected them.

Created: 2026-02-23

Indicators

• FileHash-MD5 - a7bd555866ae1c161f78630a638850e7 -
• YARA - 2bd4842e23253365d1d71e04c3189987ae66caab -
• FileHash-SHA256 - cd07ac5947c643854375603800a4f70e2dfe202c8a1f801204328921cb3a2a4c -
• FileHash-SHA256 - 1ed0c71298d7e69916fb579772f67109f43c7c9c2809fd80e61fc5e680079663 -
• FileHash-SHA256 - 01a0c03f7e01bc41e91cff5d2610ac22da77dbfd01decf60c486b500390cd3ae -
• FileHash-MD5 - 2f7e5f91be1f5be2b2f4fda0910a4c16 -
• FileHash-MD5 - 75d3d1f23628122a64a2f1b7ef33f5cf -
• FileHash-MD5 - d9821468315ccd3b9ea03161566ef18e -
• domain - inocnation.com -
• FileHash-MD5 - 4f4bf27b738ff8f2a89d1bc487b054a8 -
• FileHash-SHA256 - fce3dd4bd160b8c0698ca1dfba37bc49b3e1ad80cf77a31741bdbd2fa698be36 -
• YARA - af1d702b83a779b69c51f5fd41701f4fb97a4eed -
• hostname - mail.cbppnews.com -
• FileHash-MD5 - b9af5f5fd434a65d7aa1b55f5441c90a -
• FileHash-SHA1 - b187ed063d73d0defc6958100ca7ad04aa77fc12 -

類似Pulses

• Sakula Malware Family (score: 0.66)
• Sakula Reloaded (score: 0.64)
• Evasive Maneuvers by Wekby with Rop-packing, DNS Covert Channels (score: 0.62)
• Spam Campaign Distributes AdWind RAT (score: 0.61)
• Korplug RAT used to attack Vietnamese institutions (score: 0.61)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る