RATANKBA

Malware & Tools · RATANKBA

· MalwareS0241 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

RATANKBA is a remote controller tool used by Lazarus Group. RATANKBA has been used in attacks targeting financial institutions in Poland, Mexico, Uruguay, the United Kingdom, and Chile. It was also seen used against organizations related to telecommunications, management consulting, information technology, insurance, aviation, and education. RATANKBA has a graphical user interface to allow the attacker to issue jobs to perform on the infected machines. (Citation: Lazarus RATANKBA) (Citation: RATANKBA)

Tactic Coverage

discovery (9)execution (3)command and control (2)stealth (1)privilege escalation (1)

Used By (1 groups)

G0032Lazarus GroupLabyrinth Chollima, HIDDEN COBRA

Techniques (15)

T1007System Service Discovery

discovery

T1012Query Registry

discovery

T1016System Network Configuration Discovery

discovery

T1018Remote System Discovery

discovery

T1033System Owner/User Discovery

discovery

T1047Windows Management Instrumentation

execution

T1049System Network Connections Discovery

References

https://attack.mitre.org/software/S0241 https://www.trendmicro.com/en_us/research/17/b/ratankba-watering-holes-against-enterprises.html https://blog.trendmicro.com/trendlabs-security-intelligence/lazarus-campaign-targeting-cryptocurrencies-reveals-remote-controller-tool-evolved-ratankba/