MagicRAT

Malware & Tools · MagicRAT

· MalwareS1182 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

MagicRAT is a remote access tool developed in C++ and exclusively used by the Lazarus Group threat actor in operations. MagicRAT allows for arbitrary command execution on victim machines and provides basic remote access functionality.(Citation: Cisco MagicRAT 2022)

Tactic Coverage

stealth (5)discovery (2)execution (2)persistence (2)privilege escalation (2)command and control (2)exfiltration (1)

Used By (1 groups)

G0032Lazarus GroupLabyrinth Chollima, HIDDEN COBRA

Techniques (13)

T1016System Network Configuration Discovery

discovery

T1027.013Encrypted/Encoded File

stealth

T1036.005Match Legitimate Resource Name or Location

stealth

T1036.008Masquerade File Type

stealth

T1041Exfiltration Over C2 Channel

exfiltration

T1053.005Scheduled Task

executionpersistence

References

https://attack.mitre.org/software/S1182 https://blog.talosintelligence.com/lazarus-magicrat/