MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-23 07:17:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

add Remote Access/Administration Tools

Browse source
This commit is contained in:
Deborah Servili 2017-09-29 16:59:25 +02:00
parent ed167015d8
commit b33014e0dd
1 changed files with 709 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

713
clusters/rat.json
View file

@ -7,7 +7,7 @@
],
"description": "remote administration tool or remote access tool (RAT), also called sometimes remote access trojan, is a piece of software or programming that allows a remote \"operator\" to control a system as if they have physical access to that system.",
"uuid": "312f8714-45cb-11e7-b898-135207cdceb9",
"version": 1,
"version": 2,
"values": [
{
"meta": {
@ -299,6 +299,9 @@
"meta": {
"refs": [
"https://www.rekings.com/shop/jrat/"
],
"synonyms": [
"JacksBot"
]
},
"description": "jRAT is the cross-platform remote administrator tool that is coded in Java, Because its coded in Java it gives jRAT possibilities to run on all operation systems, Which includes Windows, Mac OSX and Linux distributions.",
@ -526,7 +529,8 @@
"meta": {
"refs": [
"http://adzok.com/"
]
],
"synonyms":
},
"description": "Remote Administrator",
"value": "Adzok"
@ -801,6 +805,9 @@
"meta": {
"refs": [
"https://www.alienvault.com/blogs/labs-research/kilerrat-taking-over-where-njrat-remote-access-trojan-left-off"
],
"synonyms": [
"Njw0rm"
]
},
"description": "This remote access trojan (RAT) has capabilities ranging from manipulating the registry to opening a reverse shell. From stealing credentials stored in browsers to accessing the victims webcam. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread utilizing physic devices, such as USB drives, but also to use the victim as a pivot point to gain more access laterally throughout the network. This remote access trojan could be classified as a variant of the well known njrat, as they share many similar features such as their display style, several abilities and a general template for communication methods . However, where njrat left off KilerRat has taken over. KilerRat is a very feature rich RAT with an active development force that is rapidly gaining in popularity amongst the middle eastern community and the world.",
@ -818,6 +825,9 @@
"http://lost-door.blogspot.lu/",
"http://blog.trendmicro.com/trendlabs-security-intelligence/lost-door-rat-accessible-customizable-attack-tool/",
"https://www.cyber.nj.gov/threat-profiles/trojan-variants/lost-door-rat"
],
"synonyms":[
"LostDoor"
]
},
"description": "Unlike most attack tools that one can only find in cybercriminal underground markets, Lost Door is very easy to obtain. It’s promoted on social media sites like YouTube and Facebook. Its maker, “OussamiO,” even has his own Facebook page where details on his creation can be found. He also has a dedicated blog (hxxp://lost-door[.]blogspot[.]com/) where tutorial videos and instructions on using the RAT is found. Any cybercriminal or threat actor can purchase and use the RAT to launch attacks.",
@ -877,10 +887,11 @@
"https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=20264"
],
"synonyms": [
"Back Door Y3K RAT "
"Back Door Y3K RAT",
"Y3k"
]
},
"value": "BD Y3K RAT "
"value": "BD Y3K RAT"
},
{
"meta": {
@ -1145,6 +1156,11 @@
"value": "5p00f3r.N$ RAT"
},
{
"meta": {
"synonyms": [
"P.Storrie RAT"
]
},
"value": "P. Storrie RAT"
},
{
@ -1176,6 +1192,695 @@
"https://www.zscaler.com/blogs/research/cobian-rat-backdoored-rat"
]
}
},
{
"description": "NetSupport Manager continues to deliver the very latest in remote access, PC support and desktop management capabilities. From a desktop, laptop, tablet or smartphone, monitor multiple systems in a single action, deliver hands-on remote support, collaborate and even record or play back sessions. When needed, gather real-time hardware and software inventory, monitor services and even view system config remotely to help resolve issues quickly.",
"value": "Netsupport Manager",
"meta": {
"refs": [
"http://www.netsupportmanager.com/index.asp"
]
}
},
{
"value": "Vortex"
},
{
"value": "Assassin"
},
{
"value": "Net Devil",
"meta": {
"refs": [
"https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=20702"
],
"synonyms": [
"NetDevil"
]
}
},
{
"value": "A4Zeta",
"meta": {
"refs": [
"http://www.megasecurity.org/trojans/a/a4zeta/A4zeta_b2.html"
]
}
},
{
"value": "Greek Hackers RAT",
"meta": {
"refs": [
"http://www.connect-trojan.net/2013/04/greek-hackers-rat-1.0.html?m=0"
]
}
},
{
"value": "MRA RAT"
},
{
"value": "Sparta RAT",
"meta": {
"refs": [
"http://www.connect-trojan.net/2015/09/sparta-rat-1.2-by-azooz-ejram.html"
]
}
},
{
"value": "LokiTech"
},
{
"value": "MadRAT"
},
{
"value": "Tequila Bandita",
"meta": {
"refs": [
"http://www.connect-trojan.net/2013/07/tequila-bandita-1.3b2.html"
]
}
},
{
"value": "Toquito Bandito",
"meta": {
"refs": [
"http://www.megasecurity.org/trojans/t/toquitobandito/Toquitobandito_all.html"
]
}
},
{
"description": "MofoTro is a new rat coded by Cool_mofo_2.",
"value": "MofoTro",
"meta": {
"refs": [
"http://www.megasecurity.org/trojans/m/mofotro/Mofotro_beta.html",
"http://www.megasecurity.org/trojans/m/mofotro/Mofotroresurrection.html",
"http://www.megasecurity.org/trojans/m/mofotro/Mofotro_beta1.5.html"
]
}
},
{
"description": "Written in Delphi",
"value": "Hav-RAT",
"meta": {
"refs": [
"http://www.megasecurity.org/trojans/h/hav/Havrat1.2.html"
]
}
},
{
"description": "ComRAT is a remote access tool suspected of being a decedent of Agent.btz and used by Turla.",
"value": "ComRAT",
"meta": {
"refs": [
"https://attack.mitre.org/wiki/Software/S0126"
]
}
},
{
"description": "4H RAT is malware that has been used by Putter Panda since at least 2007.",
"value": "4H RAT",
"meta": {
"refs": [
"https://attack.mitre.org/wiki/Software/S0065"
]
}
},
{
"description": "",
"value": "Darknet RAT",
"meta": {
"refs": [
"http://www.connect-trojan.net/2015/06/dark-net-rat-v.0.3.9.0.html"
],
"synonyms": [
"Dark NET RAT"
]
}
},
{
"value": "CIA RAT"
},
{
"value": "Minimo"
},
{
"value": "miniRAT"
},
{
"value": "Pain RAT"
},
{
"description": "PLUGX is a remote access tool (RAT) used in targeted attacks aimed toward government-related institutions and key industries. It was utilized the same way as Poison Ivy, a RAT involved in a campaign dating back to 2008.",
"value": "PlugX",
"meta": {
"refs": [
"https://www.lastline.com/labsblog/an-analysis-of-plugx-malware/",
"https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/PLUGX"
],
"synonyms": [
"Korplug"
]
}
},
{
"description": "The existence of the UNITEDRAKE RAT first came to light in 2014 as part of a series of classified documents leaked by former NSA contractor Edward Snowden.",
"value": "UNITEDRAKE",
"meta": {
"refs": [
"http://thehackernews.com/2017/09/shadowbrokers-unitedrake-hacking.html",
"https://www.itnews.com.au/news/shadowbrokers-release-unitedrake-nsa-malware-472771"
]
}
},
{
"description": "Written in Visual Basic",
"value": "MgaTrojan",
"meta": {
"refs": [
"http://www.megasecurity.org/trojans/m/mega/Megatrojan1.0.html"
]
}
},
{
"value": "Venomous Ivy"
},
{
"value": "Xploit"
},
{
"value": "Arctic R.A.T.",
"meta": {
"refs": [
"http://anti-virus-soft.com/threats/artic"
],
"synonyms": [
"Artic"
]
}
},
{
"value": "GOlden Phoenix",
"meta": {
"refs": [
"http://www.connect-trojan.net/2014/02/golden-phoenix-rat-0.2.html"
]
}
},
{
"value": "GraphicBooting",
"meta": {
"refs": [
"http://www.connect-trojan.net/2014/10/graphicbooting-rat-v0.1-beta.html?m=0"
]
}
},
{
"value": "Pocket RAT"
},
{
"value": "Erebus"
},
{
"value": "SharpEye",
"meta": {
"refs": [
"http://www.connect-trojan.net/2014/10/sharpeye-rat-1.0-beta-1.html",
"http://www.connect-trojan.net/2014/02/sharpeye-rat-1.0-beta-2.html"
]
}
},
{
"value": "VorteX",
},
{
"value": "Archelaus Beta",
"meta": {
"refs": [
"http://www.connect-trojan.net/2014/02/archelaus-rat-beta.html"
]
}
},
{
"description": "C# RAT (Remote Adminitration Tool) - Educational purposes only",
"value": "BlackHole",
"meta": {
"refs": [
"https://github.com/hussein-aitlahcen/BlackHole"
]
}
},
{
"value": "Vanguard",
"meta": {
"refs": [
"http://ktwox7.blogspot.lu/2010/12/vanguard-remote-administration.html"
]
}
},
{
"value": "Ahtapod",
"meta": {
"refs": [
"http://www.ibtimes.co.uk/turkish-journalist-baris-pehlivan-jailed-terrorism-was-framed-by-hackers-says-report-1577481"
]
}
},
{
"meta": {
"refs": [
"https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html"
]
},
"description": "Though we have not identified the targets, FINSPY is sold by Gamma Group to multiple nation-state clients, and we assess with moderate confidence that it was being used along with the zero-day to carry out cyber espionage.",
"value": "FINSPY"
},
{
"description": "Seed is a firewall bypass plus trojan, injects into default browser and has a simple purpose: to be compact (4kb server size) and useful while uploading bigger and full trojans, or even making Seed download them somewhere. Has computer info, process manager, file manager, with download, create folder, delete, execute and upload. And a remote download function. Everything with a easy to use interface, reminds an instant messenger.",
"value": "Seed RAT",
"meta": {
"refs": [
"http://www.nuclearwintercrew.com/Products-View/25/Seed_1.1/"
]
}
},
{
"value": "SharpBot"
},
{
"value": "TorCT PHP RAT",
"meta": {
"refs": [
"https://github.com/alienwithin/torCT-PHP-RAT"
]
}
},
{
"value": "A32s RAT"
},
{
"value": "Char0n"
},
{
"value": "Nytro"
},
{
"value": "Syla",
"meta": {
"refs": [
"http://www.connect-trojan.net/2013/07/syla-rat-0.3.html"
]
}
},
{
"description": "Cobalt Strike is software for Adversary Simulations and Red Team Operations.",
"value": "Cobalt Strike",
"meta": {
"refs": [
"https://www.cobaltstrike.com/"
]
}
},
{
"description": "The RAT, which according to compile timestamps first surfaced in November 2012, has been used in targeted intrusions through 2015. Sakula enables an adversary to run interactive commands as well as to download and execute additional components.",
"value": "Sakula",
"meta": {
"refs": [
"https://www.secureworks.com/research/sakula-malware-family"
],
"synonyms": [
"Sakurel",
"VIPER"
]
}
},
{
"description": "hcdLoader is a remote access tool (RAT) that has been used by APT18.",
"value": "hcdLoader",
"meta": {
"refs": [
"https://attack.mitre.org/wiki/Software/S0071"
]
}
},
{
"value": "Crimson",
"meta": {
"refs": [
"http://www.connect-trojan.net/2015/01/crimson-rat-3.0.0.html"
]
}
},
{
"value": "KjW0rm",
"meta": {
"refs": [
"http://hack-defender.blogspot.fr/2015/12/kjw0rm-v05x.html"
]
}
},
{
"value": "Ghost",
"meta": {
"refs": [
"https://www.youtube.com/watch?v=xXZW4ajVYkI"
],
"synonyms": [
"Ucul"
]
}
},
{
"value": "9002"
},
{
"value": "Sandro RAT"
},
{
"value": "Mega"
},
{
"value": "WiRAT"
},
{
"value": "3PARA RAT",
"meta": {
"refs": [
"https://books.google.fr/books?isbn=2212290136"
]
}
},
{
"value": "BBS RAT"
},
{
"description": "KONNI is a remote access Trojan (RAT) that was first reported in May of 2017, but is believed to have been in use for over 3 years. As Part of our daily threat monitoring, FortiGuard Labs came across a new variant of the KONNI RAT and decided to take a deeper look.",
"value": "Konni",
"meta": {
"refs": [
"https://blog.fortinet.com/2017/08/15/a-quick-look-at-a-new-konni-rat-variant",
"https://www.cylance.com/en_us/blog/threat-spotlight-konni-stealthy-remote-access-trojan.html",
"https://vallejo.cc/2017/07/08/analysis-of-new-variant-of-konni-rat/",
"http://blog.talosintelligence.com/2017/07/konni-references-north-korean-missile-capabilities.html"
],
"synonyms": [
"KONNI"
]
}
},
{
"value": "Felimus RAT"
},
{
"description": "Xsser mRAT is a piece of malware that targets iOS devices that have software limitations removed. The app is installed via a rogue repository on Cydia, the most popular third-party application store for jailbroken iPhones. Once the malicious bundle has been installed and executed, it gains persistence - preventing the user from deleting it. The mRAT then makes server-side checks and proceeds to steal data from the user's device and executes remote commands as directed by its command-and-control (C2) server.",
"value": "Xsser",
"meta": {
"refs": [
"https://blogs.akamai.com/2014/12/ios-and-android-os-targeted-by-man-in-the-middle-attacks.html",
"http://malware.wikia.com/wiki/Xsser_mRAT"
],
"synonyms": [
"mRAT"
]
}
},
{
"description": "GovRAT is an old cyberespionage tool, it has been in the wild since 2014 and it was used by various threat actors across the years.",
"value": "GovRAT",
"meta": {
"refs": [
"http://securityaffairs.co/wordpress/41714/cyber-crime/govrat-platform.html",
"http://securityaffairs.co/wordpress/51202/cyber-crime/govrat-2-0-attacks.html"
]
}
},
{
"value": "Rottie3",
"meta": {
"refs": [
"https://www.youtube.com/watch?v=jUg5--68Iqs"
]
}
},
{
"value": "Killer RAT",
},
{
"value": "Hi-Zor",
"meta": {
"refs": [
"https://www.fidelissecurity.com/threatgeek/2016/01/introducing-hi-zor-rat"
]
}
},
{
"description": "Quaverse RAT or QRAT is a fairly new Remote Access Tool (RAT) introduced in May 2015. This RAT is marketed as an undetectable Java RAT. As you might expect from a RAT, the tool is capable of grabbing passwords, key logging and browsing files on the victim's computer. On a regular basis for the past several months, we have observed the inclusion of QRAT in a number of spam campaigns. ",
"value": "Quaverse",
"meta": {
"refs": [
"https://www.trustwave.com/Resources/SpiderLabs-Blog/Quaverse-RAT--Remote-Access-as-a-Service/"
],
"synonyms": [
"QRAT"
]
}
},
{
"value": "Heseber",
},
{
"description": "Cardinal is a remote access trojan (RAT) discovered by Palo Alto Networks in 2017 and has been active for over two years. It is delivered via a downloader, known as Carp, and uses malicious macros in Microsoft Excel documents to compile embedded C# programming language source code into an executable that runs and deploys the Cardinal RAT. The malicious Excel files use different tactics to get the victims to execute it. ",
"value": "Cardinal",
"meta": {
"refs": [
"https://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/",
"https://www.scmagazine.com/cardinal-rats-unique-downloader-allowed-it-to-avoid-detection-for-years/article/651927/",
"https://www.cyber.nj.gov/threat-profiles/trojan-variants/cardinal"
]
}
},
{
"description": "Works on all Android, Windows, Linux and Mac devices!",
"value": "OmniRAT",
"meta": {
"refs": [
"https://omnirat.eu/en/"
]
}
},
{
"value": "Jfect",
"meta": {
"refs": [
"https://www.youtube.com/watch?v=qKdoExQFb68"
]
}
},
{
"description": "Trochilus is a remote access trojan (RAT) first identified in October 2015 when attackers used it to infect visitors of a Myanmar website. It was then used in a 2016 cyber-espionage campaign, dubbed \"the Seven Pointed Dagger,\" managed by another group, \"Group 27,\" who also uses the PlugX trojan. Trochilus is primarily spread via emails with a malicious .RAR attachment containing the malware. The trojan's functionality includes a shellcode extension, remote uninstall, a file manager, and the ability to download and execute, upload and execute, and access the system information. Once present on a system, Trochilus can move laterally in the network for better access. This trojan operates in memory only and does not write to the disk, helping it evade detection. ",
"value": "Trochilus",
"meta": {
"refs": [
"https://researchcenter.paloaltonetworks.com/2017/03/unit42-trochilus-rat-new-moonwind-rat-used-attack-thai-utility-organizations/",
"http://securityaffairs.co/wordpress/43889/cyber-crime/new-rat-trochilus.html"
]
}
},
{
"description": "Their most commonly used initial attack vector is a simple, yet alarmingly effective, spearphishing attack, infecting unsuspecting victims via a malicious email attachment (usually an executable that has been disguised as something else). From there, Matryoshka runs second stage malware via a dropper and covertly installs a Remote Access Toolkit (RAT). This is done using a reflective loader technique that allows the malware to run in process memory, rather than being written to disk. This not only hides the install of the RAT but also ensures that the RAT will be ‘reinstalled’ after system restart.",
"value": "Matryoshka",
"meta": {
"refs": [
"https://www.alienvault.com/blogs/security-essentials/matryoshka-malware-from-copykittens-group"
]
}
},
{
"description": "First discovered by Trend Micro in June, Mangit is a new malware family being marketed on both the Dark web and open internet. Users have the option to rent the trojan's infrastructure for about $600 per 10-day period or buy the source code for about $8,800. Mangit was allegedly developed by \"Ric\", a Brazilian hacker, who makes himself available via Skype to discuss rental agreements. Once the malware is rented or purchased, the user controls a portion of the Mangit botnet, the trojan, the dropper, an auto-update system, and the server infrastructure to run their attacks. Mangit contains support for nine Brazillian banks including Citibank, HSBC, and Santander. The malware can also be used to steal user PayPal credentials. Mangit has the capability to collect banking credentials, receive SMS texts when a victim is accessing their bank account, and take over victim's browsers. To circumvent two-factor authentication, attackers can use Mangit to lock victim's browsers and push pop-ups to the victim asking for the verification code they just received.",
"value": "Mangit",
"meta": {
"refs": [
"http://virusguides.com/newly-discovered-mangit-malware-offers-banking-trojan-service/",
"https://www.cyber.nj.gov/threat-profiles/trojan-variants/mangit",
"http://news.softpedia.com/news/new-malware-mangit-surfaces-as-banking-trojan-as-a-service-505458.shtml"
]
}
},
{
"value": "LeGeNd",
"meta": {
"refs": [
"http://www.connect-trojan.net/2016/08/legend-rat-v1.3-by-ahmed-ibrahim.html",
"http://www.connect-trojan.net/2016/11/legend-rat-v1.9-by-ahmed-ibrahim.html"
]
}
},
{
"description": "Revenge v0.1 was a simple tool, according to a researcher known as Rui, who says the malware’s author didn’t bother obfuscating the RAT’s source code. This raised a question mark with the researchers, who couldn’t explain why VirusTotal scanners couldn’t pick it up as a threat right away.Revenge, which was written in Visual Basic, also didn’t feature too many working features, compared to similar RATs. Even Napolean admitted that his tool was still in the early development stages, a reason why he provided the RAT for free.",
"value": "revenge-RAT",
"meta": {
"refs": [
"http://www.securitynewspaper.com/2016/08/31/unsophisticated-revenge-rat-released-online-free-exclusive/"
]
}
},
{
"value": "vjw0rm 0.1",
"meta": {
"refs": [
"https://twitter.com/malwrhunterteam/status/816993165119016960?lang=en"
]
}
},
{
"description": "ROKRAT is a remote access trojan (RAT) that leverages a malicious Hangual Word Processor (HWP) document sent in spearphishing emails to infect hosts. The HWP document contains an embedded Encapsulated PostScript (EPS) object. The object exploits an EPS buffer overflow vulnerability and downloads a binary disguised as a .JPG file. The file is then decoded and the ROKRAT executable is initiated. The trojan uses legitimate Twitter, Yandex, and Mediafire websites for its command and control communications and exfiltration platforms, making them difficult to block globally. Additionally, the platforms use HTTPS connections, making it more difficult to gather additional data on its activities. Cisco's Talos Group identified two email campaigns. In one, attackers send potential victims emails from an email server of a private university in Seoul, South Korea with a sender email address of \"kgf2016@yonsei.ac.kr,\" the contact email for the Korea Global Forum, adding a sense of legitimacy to the email. It is likely that the email address was compromised and used by the attackers in this campaign. The second is less sophisticated and sends emails claiming to be from a free Korean mail service with a the subject line, "Request Help" and attached malicious HWP filename, "I'm a munchon person in Gangwon-do, North Korea." The ROKRAT developer uses several techniques to hinder analysis, including identifying tools usually used by malware analysts or within sandbox environments. Once it has infected a device, this trojan can execute commands, move a file, remove a file, kill a process, download and execute a file, upload documents, capture screenshots, and log keystrokes. Researchers believe the developer is a native Korean speaker and the campaign is currently targeting Korean-speakers.",
"value": "rokrat",
"meta": {
"refs": [
"http://blog.talosintelligence.com/2017/04/introducing-rokrat.html"
]
}
},
{
"description": "Travelers applying for a US Visa in Switzerland were recently targeted by cyber-criminals linked to a malware called QRAT. Twitter user @hkashfi posted a Tweet saying that one of his friends received a file (US Travel Docs Information.jar) from someone posing as USTRAVELDOCS.COM support personnel using the Skype account ustravelidocs-switzerland (notice the “i” between “travel” and “docs”).",
"value": "Qarallax",
"meta": {
"refs": [
"https://labsblog.f-secure.com/2016/06/07/qarallax-rat-spying-on-us-visa-applicants/"
],
"synonyms": [
"qrat"
]
}
},
{
"description": "MoonWind is a remote access tool (RAT) that was used in 2016 to target organizations in Thailand.",
"value": "MoonWind",
"meta": {
"refs": [
"https://researchcenter.paloaltonetworks.com/2017/03/unit42-trochilus-rat-new-moonwind-rat-used-attack-thai-utility-organizations/",
"https://attack.mitre.org/wiki/Software/S0149"
]
}
},
{
"description": "Remcos is another RAT (Remote Administration Tool) that was first discovered being sold in hacking forums in the second half of 2016. Since then, it has been updated with more features, and just recently, we’ve seen its payload being distributed in the wild for the first time.",
"value": "Remcos",
"meta": {
"refs": [
"https://blog.fortinet.com/2017/02/14/remcos-a-new-rat-in-the-wild-2"
]
}
},
{
"description": "The purpose of the Client Maximus malware is financial fraud. As such, its code aspires to create the capabilities that most banking Trojans have, which allow attackers to monitor victims’ web navigation and interrupt online banking session at will. After taking over a victim’s banking session, an attacker operating this malware can initiate a fraudulent transaction from the account and use social engineering screens to manipulate the unwitting victim into authorizing it.",
"value": "Client Maximus",
"meta": {
"refs": [
"https://securityintelligence.com/client-maximus-new-remote-overlay-malware-highlights-rising-malcode-sophistication-in-brazil/"
]
}
},
{
"description": "Thefatrat a massive exploiting tool revealed >> An easy tool to generate backdoor and easy tool to post exploitation attack like browser attack,dll . This tool compiles a malware with popular payload and then the compiled malware can be execute on windows, android, mac . The malware that created with this tool also have an ability to bypass most… ",
"value": "TheFat RAT",
"meta": {
"refs": [
"https://github.com/Screetsec/TheFatRat"
]
}
},
{
"description": "Since around October 2016, JPCERT/CC has been confirming information leakage and other damages caused by malware ‘RedLeaves’. It is a new type of malware which has been observed since 2016 in attachments to targeted emails.",
"value": "RedLeaves",
"meta": {
"refs": [
"http://blog.jpcert.or.jp/2017/04/redleaves---malware-based-on-open-source-rat.html"
]
}
},
{
"description": "Dubbed Rurktar, the tool hasn’t had all of its functionality implemented yet, but G DATA says “it is relatively safe to say [it] is intended for use in targeted spying operations.” The malicious program could be used for reconnaissance operations, as well as to spy on infected computers users, and steal or upload files.",
"value": "Rurktar",
"meta": {
"refs": [
"http://www.securityweek.com/rurktar-malware-espionage-tool-development"
]
}
},
{
"description": "RATAttack is a remote access trojan (RAT) that uses the Telegram protocol to support encrypted communication between the victim's machine and the attacker. The Telegram protocol also provides a simple method to communicate to the target, negating the need for port forwarding. Before using RATAttack, the attacker must create a Telegram bot and embed the bot's Telegram token into the trojan's configuration file. When a system is infected with RATAttack, it connects to the bot's Telegram channel. The attacker can then connect to the same channel and manage the RATAttack clients on the infected host machines. The trojan's code was available on GitHub then was taken down by the author on April 19, 2017.",
"value": "RATAttack",
"meta": {
"refs": [
"https://www.cyber.nj.gov/threat-profiles/trojan-variants/ratattack"
]
}
},
{
"description": "So called because the Command and Control (C2) infrastructure from previous variants of the malware was located in Cambodia, as discussed by Roland Dela Paz at Forecpoint here, KHRAT is a Trojan that registers victims using their infected machine’s username, system language and local IP address. KHRAT provides the threat actors typical RAT features and access to the victim system, including keylogging, screenshot capabilities, remote shell access and so on.",
"value": "KhRAT",
"meta": {
"refs": [
"https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/"
]
}
},
{
"description": "",
"value": "RevCode",
"meta": {
"refs": [
"https://revcode.eu/"
]
}
},
{
"description": "Android Remote Administration Tool",
"value": "AhNyth Android",
"meta": {
"refs": [
"https://github.com/AhMyth/AhMyth-Android-RAT"
]
}
},
{
"value": "PowerRAT",
},
{
"description": "MacSpy is advertised as the \"most sophisticated Mac spyware ever\", with the low starting price of free. While the idea of malware-as-a-service (MaaS) isn’t a new one with players such as Tox and Shark the game, it can be said that MacSpy is one of the first seen for the OS X platform.",
"value": "MacSpy",
"meta": {
"refs": [
"https://www.alienvault.com/blogs/labs-research/macspy-os-x-rat-as-a-service"
]
}
},
{
"description": "Talos recently analyzed an interesting malware sample that made use of DNS TXT record queries and responses to create a bidirectional Command and Control (C2) channel. This allows the attacker to use DNS communications to submit new commands to be run on infected machines and return the results of the command execution to the attacker. This is an extremely uncommon and evasive way of administering a RAT. The use of multiple stages of Powershell with various stages being completely fileless indicates an attacker who has taken significant measures to avoid detection. ",
"value": "DNSMessenger",
"meta": {
"refs": [
"http://blog.talosintelligence.com/2017/03/dnsmessenger.html"
]
}
},
{
"value": "PentagonRAT",
"meta": {
"refs": [
"http://pentagon-rat.blogspot.fr/"
]
}
},
{
"description": "NewCore is a remote access trojan first discovered by Fortinet researchers while conducting analysis on a China-linked APT campaign targeting Vietnamese organizations. The trojan is a DLL file, executed after a trojan downloader is installed on the targeted machine. Based on strings in the code, the trojan may be compiled from the publicly-available source code of the PcClient and PcCortr backdoor trojans.",
"value": "NewCore",
"meta": {
"refs": [
"https://www.cyber.nj.gov/threat-profiles/trojan-variants/newcore"
]
}
}
]
}