I2PRATMalware
- i2parcae
According to Cofense, this malware is notable for having several unique tactics, techniques, and procedures (TTPs), such as Secure Email Gateway (SEG) evasion by proxying emails through legitimate infrastructure, fake CAPTCHAs, abusing hardcoded Windows functionality to hide dropped files, and C2 capabilities over Invisible Internet Project (I2P), a peer-to-peer anonymous network with end-to-end…From MISP Galaxy
Last reported 4 months ago, by Sekoia.io1 report
ATT&CK techniques
6 of 14 · each with the sentence it comes from- T1027.002Software Packing
“Defense EvasionT1027.002 - Software Packing”
- T1027.007Dynamic API Resolution
“Evasion techniques include dynamic API resolution with an undocumented hash, debugger suspension and XOR string obfuscation.”
- T1027.013Encrypted/Encoded File
“Defense EvasionT1027.013 - Encrypted/Encoded File”
- T1036Masquerading
“Defense EvasionT1036 - Masquerading”
- T1053.005Scheduled Task
“prgmgr.dll: launches scheduled task using schtasks subdirectory to collect information on the host (memory status, network setup, installed web browser).”
- T1055Process Injection
“Defense EvasionT1055.003 - Process Injection: Thread Execution Hijacking”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
RATatouille: Cooking Up Chaos in the I2P Kitchen“Discover the challenges of ClickFix12 and the newly identified I2PRAT.”
Indicators in its reports
named in the reports above- 64.95.10[.]162in 1 report
- 194.26.135[.]9in 1 report
- 194.26.135[.]10in 1 report
- 60000000000000000000000000000000in 1 report
- 154.216.20[.]137in 1 report
- dp.memory[.]mapin 1 report
- mem[.]infoin 1 report
- export[.]namein 1 report
- dp[.]callin 1 report
Copy these 9 indicators · defanged
Thanks — we review every report.