MITRE ATT&CKsoftware (malware)

S0428 PoetRAT

Published 2020-04-27 Modified 2024-08-05 Official page ↗
Domain
enterprise
Platforms
Windows
Version
2.3
Created
2020-04-27

Description

PoetRAT is a remote access trojan (RAT) that was first identified in April 2020. PoetRAT has been used in multiple campaigns against the private and public sectors in Azerbaijan, including ICS and SCADA systems in the energy sector. The STIBNITE activity group has been observed using the malware. PoetRAT derived its name from references in the code to poet William Shakespeare.

Related

Uses · MITRE ATT&CK (35)

  • T1059.011 Lua sub-technique
  • T1027.010 Command Obfuscation sub-technique
  • T1573.002 Asymmetric Cryptography sub-technique
  • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1071.002 File Transfer Protocols sub-technique
  • T1571 Non-Standard Port technique
  • T1204.002 Malicious File sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1059.005 Visual Basic sub-technique
  • T1059.006 Python sub-technique
  • T1497.001 System Checks sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1564.001 Hidden Files and Directories sub-technique
  • T1560.001 Archive via Utility sub-technique
  • T1555.003 Credentials from Web Browsers sub-technique
  • T1559.002 Dynamic Data Exchange sub-technique
  • T1003.001 LSASS Memory sub-technique
  • T1056.001 Keylogging sub-technique
  • T1070.004 File Deletion sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1018 Remote System Discovery technique
  • T1027 Obfuscated Files or Information technique
  • T1033 System Owner/User Discovery technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1048 Exfiltration Over Alternative Protocol technique
  • T1057 Process Discovery technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
Show all 35 ›

References