ctrlINT What the industry said about every indicator, with the quote

SparkRATMalware

SparkRAT is a cross-platform, open-source Remote Administration Tool (RAT) written in Go and released on GitHub in 2022. Compatible with Windows, macOS, and Linux systems, it offers extensive remote access capabilities, including file and process management, file transfer, remote desktop monitoring, system information collection, and command execution via terminal access.From MISP Galaxy

Last reported 10 months ago, by Huntress1 report

ATT&CK techniques

2 techniques · each with the sentence it comes from
  1. T1505.003Web Shell

    “This is less likely to indicate that a web shell had been dropped on the endpoint via a file write/upload vulnerability, and more likely that some flaw in the code of the page may have been exploited.”

    HuntressVendor
  2. T1543.003Windows Service

    “Following the attrib.exe command, the Service Control Manager (sc.exe) was used to create persistence, and launch dllhost.exe as a Windows service named WindowsUpdate.”

    HuntressVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

1 report, newest first · the exact sentence from each

  1. “Based on hash comparison, the file dllhost.exe is a copy of agent.exe, which in this incident, was identified via VirusTotal as SparkRAT.”

    HuntressVendor
    Trial, Error & Typos: Malware Isn't Always 'Sophisticated'

Indicators in its reports

named in the reports above
Copy these 10 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with SparkRAT here?
No account needed. We do not store your IP address.