MITRE ATT&CKsoftware (malware)
S1182 MagicRAT
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.0
- Created
- 2024-12-30
Description
MagicRAT is a remote access tool developed in C++ and exclusively used by the Lazarus Group threat actor in operations. MagicRAT allows for arbitrary command execution on victim machines and provides basic remote access functionality.
Related
Uses · MITRE ATT&CK (13)
- T1027.013 Encrypted/Encoded File sub-technique
- T1036.008 Masquerade File Type sub-technique
- T1071.001 Web Protocols sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1070.004 File Deletion sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1053.005 Scheduled Task sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1016 System Network Configuration Discovery technique
- T1041 Exfiltration Over C2 Channel technique
- T1082 System Information Discovery technique
- T1105 Ingress Tool Transfer technique
Referenced by MITRE ATT&CK · uses (1)
- G0032 Lazarus Group group
References
- https://blog.talosintelligence.com/lazarus-magicrat/ Cisco MagicRAT 2022