MarkiRAT

Malware & Tools · MarkiRAT

· MalwareS0652 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

MarkiRAT is a remote access Trojan (RAT) compiled with Visual Studio that has been used by Ferocious Kitten since at least 2015.(Citation: Kaspersky Ferocious Kitten Jun 2021)

Tactic Coverage

discovery (7)collection (5)execution (3)persistence (3)stealth (2)credential access (2)command and control (2)privilege escalation (2)exfiltration (1)

Used By (1 groups)

G0137Ferocious Kitten

Techniques (22)

T1005Data from Local System

collection

T1033System Owner/User Discovery

discovery

T1036.005Match Legitimate Resource Name or Location

stealth

T1041Exfiltration Over C2 Channel

exfiltration

T1056.001Keylogging

collectioncredential access

T1057Process Discovery

discovery

References

https://attack.mitre.org/software/S0652 https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/

Windows Command Shell

T1071.001Web Protocols

command and control

T1074.001Local Data Staging

collection

T1082System Information Discovery

discovery

T1083File and Directory Discovery

discovery

T1105Ingress Tool Transfer

command and control

T1106Native API

execution

T1113Screen Capture

collection

T1115Clipboard Data

collection

T1197BITS Jobs

stealthpersistence

T1518Software Discovery

discovery

T1518.001Security Software Discovery

discovery

T1547.001Registry Run Keys / Startup Folder

persistenceprivilege escalation

T1547.009Shortcut Modification

persistenceprivilege escalation

T1555.005Password Managers

credential access

T1614.001System Language Discovery

discovery