Archer RATMalware
- archer rat / rustric
- rustywater
RustyWater is a Rust-based implant used by MuddyWater. Historically, MuddyWater has used PowerShell-based tools and RustyWater reflects a shift in tooling, demonstrating better techniques for defense evasion and reverse engineering.From MITRE ATT&CK
Last reported 8 months ago, by Group-IB1 report
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1053.005Scheduled Task
“Additional actions include local network scanning via ping, creation of scheduled tasks, and the ingress tool transfer which are then executed.”
- T1105Ingress Tool Transfer
“Additional actions include local network scanning via ping, creation of scheduled tasks, and the ingress tool transfer which are then executed.”
- T1219Remote Access Tools
“AnyDesk Binaries: Legitimate remote access tools used for direct control of infected hosts.”
- T1620Reflective Code Loading
“Deploy and tune EDR solutions to detect reflective code loading and in-memory execution, as GhostFetch decrypts AES-encrypted payloads and loads them directly into memory.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Operation Olalampo: Inside MuddyWater’s Latest Campaign“The CHAR malware has similar structure and development environment as the Rust-based malware BlackBeard (aka “Archer RAT”, sha-1: 326b808f4f933f20e4e8686e9a6e93454c8ed334).,”
Indicators in its reports
named in the reports above- 162.0.230[.]185in 1 report
- promoverse[.]orgin 1 report
- 209.74.87[.]67in 1 report
- netvigil[.]orgin 1 report
- miniquest[.]orgin 1 report
- 159.198.43[.]141in 1 report
- 209.74.87[.]100in 1 report
- hxxp://127.0.0[.]1:8080in 1 report
- hxxp://127.0.0[.]1:8080/testin 1 report
- hxxp://127.0.0[.]1:8080/in 1 report
- hxxps://codefusiontech[.]orgin 1 report
- codefusiontech[.]orgin 1 report
- hxxp://143.198.5[.]41:443/successin 1 report
- 143.198.5[.]41in 1 report
- 62ed16701a14ce26…2fe606c15407in 1 report
- 02ccc4271362b92a…e2867cc662a5in 1 report
- 326b808f4f933f20…93454c8ed334in 1 report
- jerusalemsolutions[.]comin 1 report
- f4e0f4449dc50e33…93dd8e4bc55din 1 report
- 3441306816018d08…fac0200e9152in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.