MITRE ATT&CKsoftware (malware)

S0694 DRATzarus

Published 2022-03-24 Modified 2025-04-16 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.1
Created
2022-03-24

Description

DRATzarus is a remote access tool (RAT) that has been used by Lazarus Group to target the defense and aerospace organizations globally since at least summer 2020. DRATzarus shares similarities with Bankshot, which was used by Lazarus Group in 2017 to target the Turkish financial sector.

Related

Uses · MITRE ATT&CK (13)

  • T1622 Debugger Evasion technique
  • T1071.001 Web Protocols sub-technique
  • T1497.003 Time Based Checks sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1027.002 Software Packing sub-technique
  • T1005 Data from Local System technique
  • T1018 Remote System Discovery technique
  • T1027 Obfuscated Files or Information technique
  • T1033 System Owner/User Discovery technique
  • T1057 Process Discovery technique
  • T1105 Ingress Tool Transfer technique
  • T1106 Native API technique
  • T1124 System Time Discovery technique

Referenced by MITRE ATT&CK · uses (1)

  • C0022 Operation Dream Job campaign

References