Action RAT

Malware & Tools · Action RAT

· MalwareS1028 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

Action RAT is a remote access tool written in Delphi that has been used by SideCopy since at least December 2021 against Indian and Afghani government personnel.(Citation: MalwareBytes SideCopy Dec 2021)

Tactic Coverage

discovery (5)stealth (2)execution (2)command and control (2)collection (1)

Used By (1 groups)

G1008SideCopy

Techniques (12)

T1005Data from Local System

collection

T1016System Network Configuration Discovery

discovery

T1027Obfuscated Files or Information

stealth

T1033System Owner/User Discovery

discovery

T1047Windows Management Instrumentation

execution

T1059.003Windows Command Shell

execution

T1071.001Web Protocols

References

https://attack.mitre.org/software/S1028 https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure