MITRE ATT&CKsoftware (malware)
S0237 GravityRAT
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.3
- Created
- 2018-10-17
Description
GravityRAT is a remote access tool (RAT) and has been in ongoing development since 2016. The actor behind the tool remains unknown, but two usernames have been recovered that link to the author, which are "TheMartian" and "The Invincible." According to the National Computer Emergency Response Team (CERT) of India, the malware has been identified in attacks against organization and entities in India.
Related
Uses · MITRE ATT&CK (19)
- T1027.013 Encrypted/Encoded File sub-technique
- T1027.005 Indicator Removal from Tools sub-technique
- T1071.001 Web Protocols sub-technique
- T1571 Non-Standard Port technique
- T1059.003 Windows Command Shell sub-technique
- T1497.001 System Checks sub-technique
- T1559.002 Dynamic Data Exchange sub-technique
- T1053.005 Scheduled Task sub-technique
- T1005 Data from Local System technique
- T1007 System Service Discovery technique
- T1016 System Network Configuration Discovery technique
- T1025 Data from Removable Media technique
- T1033 System Owner/User Discovery technique
- T1047 Windows Management Instrumentation technique
- T1049 System Network Connections Discovery technique
- T1057 Process Discovery technique
- T1082 System Information Discovery technique
- T1083 File and Directory Discovery technique
- T1124 System Time Discovery technique