MagicRAT
Techniques Used |
||||
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols |
MagicRAT uses HTTP POST communication for command and control.(Citation: Cisco MagicRAT 2022) |
| Enterprise | T1547 | .001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
MagicRAT can persist using malicious LNK objects in the victim machine Startup folder.(Citation: Cisco MagicRAT 2022) |
| Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell |
MagicRAT allows for the execution of arbitrary commands on the victim system.(Citation: Cisco MagicRAT 2022) |
| Enterprise | T1070 | .004 | Indicator Removal: File Deletion |
MagicRAT can delete files on victim systems, including itself.(Citation: Cisco MagicRAT 2022) |
| Enterprise | T1036 | .005 | Masquerading: Match Legitimate Resource Name or Location |
MagicRAT stores configuration data in files and file paths mimicking legitimate operating system resources.(Citation: Cisco MagicRAT 2022) |
| .008 | Masquerading: Masquerade File Type |
MagicRAT can download additional executable payloads that masquerade as GIF files.(Citation: Cisco MagicRAT 2022) |
||
| Enterprise | T1027 | .013 | Obfuscated Files or Information: Encrypted/Encoded File |
MagicRAT stores base64 encoded command and contorl URLs in a configuraiton file, with each URL prefixed with the value `LR02DPt22R`.(Citation: Cisco MagicRAT 2022) |
| Enterprise | T1053 | .005 | Scheduled Task/Job: Scheduled Task |
MagicRAT can persist via scheduled tasks.(Citation: Cisco MagicRAT 2022) |
Groups That Use This Software |
||
| ID | Name | References |
|---|---|---|
| G0032 | Lazarus Group |
(Citation: Cisco MagicRAT 2022) |
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.