9002 RATMalware
- hidraq
- homeunix
- homux
- hydraq
- McRat
- mdmbot
- onekeylocker
- roarur
9002 RAT is a Remote Access Tool typically observed to be used by an APT to control a victim's machine. It has been spread over via zero day exploits (e.g. targeting Internet Explorer) as well as via email attachments. The infection chain starts by opening a. LNK (an OLE packager shell object) that executes a Powershell command.From MISP Galaxy
Last reported 5 months ago, by ESET WeLiveSecurity (ES)3 reports
ATT&CK techniques
6 of 39 · each with the sentence it comes from- T1005Data from Local System
“T1005”
- T1021.007Cloud Services
“T1021.007”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Encrypted/Encoded File”
- T1027.013Encrypted/Encoded File
“T1027.013”
- T1041Exfiltration Over C2 Channel
“T1041”
- T1053Scheduled Task/Job
“Scheduled Task/Job: Scheduled Task”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Webworm: el grupo APT evoluciona sus tácticas y se apoya en plataformas legítimas“En el pasado, utilizó familias de malware conocidas como McRat (también llamado 9002 RAT) y Trochilus, aunque en los últimos años ha comenzado a migrar hacia herramientas proxy, tanto existentes como personalizadas, que son más sigilosas que los…”
-
Webworm: New burrowing techniques“In the past, it made use of well-known malware families such as McRat (aka 9002 RAT) and Trochilus, though in recent years, it has started moving toward both existing and custom proxy tools, which are more stealthy than full-fledged backdoors.”
-
Hunting In Memory“The following screenshot shows a sample detection when run on a system infected with a 9002 RAT sample.”
Indicators in its reports
named in the reports above- wamanharipethe.s3.ap-south-1.amazonaws[.]comin 2 reports
- whpjewellers.s3.amazonaws[.]comin 2 reports
- hxxps://github[.]com/anjsdgasdf/WordPressin 2 reports
- 64.176.85[.]158in 2 reports
- socket[.]ioin 2 reports
- cb4e504333367073…3cbe8d497d98in 2 reports
- 1df40a4a31b30b62…c4408302adc7in 2 reports
- 7dcfe9ee25841dfd…67fe32141dfbin 2 reports
- 77f1970d620216c5…13fccc267217in 2 reports
- 948159a7fc2e6883…40dffc4b24d6in 2 reports
- a3c077bdf8898e61…960834adb2a9in 2 reports
- 45.77.13[.]67in 2 reports
- 104.243.23[.]43in 2 reports
- 108.61.200[.]151in 2 reports
- 144.168.60[.]233in 2 reports
Copy these 15 indicators · defanged
Thanks — we review every report.