ctrlINT What the industry said about every indicator, with the quote

oRATMalware

SentinelOne describes this as a malware written in Go, mixing own custom code with code from public repositories.From MISP Galaxy

Last reported 1 month ago, by Infosecurity Magazine2 reports

ATT&CK techniques

6 of 10 · each with the sentence it comes from
  1. T1003.007Proc Filesystem

    “…unt mode is enabled, the agent bind-mounts over its own /proc/<pid> entry, disrupting inspection of the running process through the proc filesystem.”

    Check Point ResearchVendor
  2. T1014Rootkit

    “… and mode, the C2 domain, the TLS SNI camouflage value used for the certificates, and the directory, filename, and loader names for the rootkit.”

    Check Point ResearchVendor
  3. T1070.006Timestomp

    “What follows is a deliberate effort to hide the intrusion: the script deletes the source and all build artifacts, then timestomps the resulting .so and its load-configuration files to match legitimate, pre-existing Apache modules such as mod_ssl or mod_suexec, so the malicious fi…”

    Check Point ResearchVendor
  4. T1110Brute Force

    “subfinder – takes root domains, resolvers, and a depth, then enumerates subdomains via DNS brute force, certificate transparency, and passive sources, returning the discovered subdomains.”

    Check Point ResearchVendor
  5. T1218.002Control Panel

    “…alent, pulling DocumentRoot, ServerName, and ServerAlias from every VirtualHost block across the standard Debian, RedHat, and common control-panel configuration paths.”

    Check Point ResearchVendor
  6. T1543.002Systemd Service

    “It installs itself to /usr/local/bin/xtables-addons and registers a systemd service named xtables-addons, wired into the standard multi-user target so it starts on boot as root.”

    Check Point ResearchVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

2 reports, newest first · the exact sentence from each

  1. “The research, published on September 2, said the overlaps covered tooling, operator artifacts and infrastructure, including the use of oRAT, Chinese-language strings and domains resembling trusted technology brands.”

    Infosecurity MagazineNews
    Gambling Goblin Turns Brazilian Government Sites Into SEO Weapons

  2. “Once inside a host, the group deploys custom tools – downloader (DownPro), multiple backdoors including the modular AlphaAgent and the oRAT RAT, a 3snake-based credential stealer, an SSH brute-forcer, and a plugin-driven reconnaissance agent.”

    Check Point ResearchVendor
    Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with oRAT here?
No account needed. We do not store your IP address.