MITRE ATT&CKsoftware (malware)

S0126 ComRAT

Published 2017-05-31 Modified 2025-04-16 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.4
Created
2017-05-31

Description

ComRAT is a second stage implant suspected of being a descendant of Agent.btz and used by Turla. The first version of ComRAT was identified in 2007, but the tool has undergone substantial development for many years since.

Related

Uses · MITRE ATT&CK (22)

  • T1027.011 Fileless Storage sub-technique
  • T1027.010 Command Obfuscation sub-technique
  • T1027.009 Embedded Payloads sub-technique
  • T1564.005 Hidden File System sub-technique
  • T1546.015 Component Object Model Hijacking sub-technique
  • T1573.002 Asymmetric Cryptography sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1071.003 Mail Protocols sub-technique
  • T1102.002 Bidirectional Communication sub-technique
  • T1059.001 PowerShell sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1036.004 Masquerade Task or Service sub-technique
  • T1055.001 Dynamic-link Library Injection sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1518 Software Discovery technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1012 Query Registry technique
  • T1027 Obfuscated Files or Information technique
  • T1029 Scheduled Transfer technique
  • T1106 Native API technique
  • T1112 Modify Registry technique
  • T1124 System Time Discovery technique

Referenced by MITRE ATT&CK · uses (1)

References