forked from MISP/misp-galaxy
/
rat.json
3492 lines (3492 loc) · 135 KB
/
rat.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
{
"authors": [
"Various",
"raw-data"
],
"category": "tool",
"description": "remote administration tool or remote access tool (RAT), also called sometimes remote access trojan, is a piece of software or programming that allows a remote \"operator\" to control a system as if they have physical access to that system.",
"name": "RAT",
"source": "MISP Project",
"type": "rat",
"uuid": "312f8714-45cb-11e7-b898-135207cdceb9",
"values": [
{
"description": "Iperius Remote is advertised with these features: Control remotely any computer with Iperius Remote Desktop Free. For remote support or presentations. Ideal for technical assistance. Easy to use and secure.",
"meta": {
"refs": [
"https://www.iperiusremote.com"
]
},
"uuid": "5abe8673-4f85-440b-8860-de39fc1b671c",
"value": "Iperius Remote"
},
{
"description": "TeamViewer is a proprietary computer software package for remote control, desktop sharing, online meetings, web conferencing and file transfer between computers.",
"meta": {
"refs": [
"https://www.teamviewer.com"
]
},
"uuid": "8ee3c015-3088-4a5f-8c94-602c27d767c0",
"value": "TeamViewer"
},
{
"description": "JadeRAT is just one example of numerous mobile surveillanceware families we've seen in recent months, indicating that actors are continuing to incorporate mobile tools in their attack chains. Threat actor, using a tool called JadeRAT, targets the mobile phones of ethnic minorities in China, notably Uighurs, for the purpose of espionage. ",
"meta": {
"cfr-suspected-state-sponsor": "China",
"cfr-suspected-victims": [
"Ethnic minorities in China"
],
"cfr-target-category": [
"Government",
"Civil society"
],
"cfr-type-of-incident": "Espionage",
"refs": [
"https://blog.lookout.com/mobile-threat-jaderat",
"https://www.cfr.org/interactive/cyber-operations/jaderat"
]
},
"related": [
{
"dest-uuid": "8804e02c-a139-4c3d-8901-03302ca1faa0",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
}
],
"uuid": "1cc8963b-5ad4-4e19-8e9a-57b0ff1ef926",
"value": "JadeRAT"
},
{
"description": "Back Orifice (often shortened to BO) is a computer program designed for remote system administration. It enables a user to control a computer running the Microsoft Windows operating system from a remote location.",
"meta": {
"refs": [
"http://www.cultdeadcow.com/tools/bo.html",
"http://www.symantec.com/avcenter/warn/backorifice.html"
],
"synonyms": [
"BO"
]
},
"uuid": "20204b13-8ad1-4147-9328-0a9a7ac010b6",
"value": "Back Orifice"
},
{
"description": "NetBus or Netbus is a software program for remotely controlling a Microsoft Windows computer system over a network. It was created in 1998 and has been very controversial for its potential of being used as a backdoor.",
"meta": {
"date": "1998",
"refs": [
"http://www.symantec.com/avcenter/warn/backorifice.html",
"https://www.f-secure.com/v-descs/netbus.shtml"
],
"synonyms": [
"NetBus"
]
},
"uuid": "81ff6e46-0ba4-458b-b3b0-750e86404cae",
"value": "Netbus"
},
{
"description": "Poison Ivy is a RAT which was freely available and first released in 2005.",
"meta": {
"refs": [
"https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-poison-ivy.pdf",
"https://www.f-secure.com/v-descs/backdoor_w32_poisonivy.shtml"
],
"synonyms": [
"Poison Ivy",
"Backdoor.Win32.PoisonIvy",
"Gen:Trojan.Heur.PT"
]
},
"related": [
{
"dest-uuid": "b42378e0-f147-496f-992a-26a49705395b",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "2abe89de-46dd-4dae-ae22-b49a593aff54",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "e336aeba-b61a-44e0-a0df-cd52a5839db5",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "7789fc1b-3cbc-4a1c-8ef0-8b06760f93e7",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "c82c904f-b3b4-40a2-bf0d-008912953104",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "used-by"
}
],
"uuid": "4e104fef-8a2c-4679-b497-6e86d7d47db0",
"value": "PoisonIvy"
},
{
"description": "Sub7, or SubSeven or Sub7Server, is a Trojan horse program.[1] Its name was derived by spelling NetBus backwards (\"suBteN\") and swapping \"ten\" with \"seven\". Sub7 was created by Mobman. Mobman has not maintained or updated the software since 2004, however an author known as Read101 has carried on the Sub7 legacy.",
"meta": {
"date": "1999",
"refs": [
"https://www.symantec.com/security_response/writeup.jsp?docid=2001-020114-5445-99"
],
"synonyms": [
"SubSeven",
"Sub7Server"
]
},
"uuid": "d7369f05-65ce-4e10-916f-41f2f6d4ab59",
"value": "Sub7"
},
{
"description": "Beast is a Windows-based backdoor trojan horse, more commonly known in the hacking community as a Remote Administration Tool or a \"RAT\". It is capable of infecting versions of Windows from 95 to 10.",
"meta": {
"date": "2002",
"refs": [
"https://en.wikipedia.org/wiki/Beast_(Trojan_horse)"
]
},
"uuid": "268a4f81-dbfd-4b20-9a54-24eba7a4c781",
"value": "Beast Trojan"
},
{
"description": "Bifrost is a discontinued backdoor trojan horse family of more than 10 variants which can infect Windows 95 through Windows 10 (although on modern Windows systems, after Windows XP, its functionality is limited). Bifrost uses the typical server, server builder, and client backdoor program configuration to allow a remote attacker, who uses the client, to execute arbitrary code on the compromised machine (which runs the server whose behavior can be controlled by the server editor).",
"meta": {
"date": "2004",
"refs": [
"https://www.revolvy.com/main/index.php?s=Bifrost%20(trojan%20horse)&item_type=topic",
"http://malware-info.blogspot.lu/2008/10/bifrost-trojan.html"
]
},
"uuid": "eb62bac0-68fd-4b17-af4f-89c6900ee414",
"value": "Bifrost"
},
{
"description": "Blackshades is the name of a malicious trojan horse used by hackers to control computers remotely. The malware targets computers using Microsoft Windows -based operating systems.[2] According to US officials, over 500,000 computer systems have been infected worldwide with the software.",
"meta": {
"date": "2010",
"refs": [
"https://krebsonsecurity.com/2014/05/blackshades-trojan-users-had-it-coming/"
]
},
"related": [
{
"dest-uuid": "8c3202d5-1671-46ec-9d42-cb50dbe2f667",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
}
],
"uuid": "3a1fc564-3705-4cc0-8f80-13c58d470d34",
"value": "Blackshades"
},
{
"description": "DarkComet is a Remote Administration Tool (RAT) which was developed by Jean-Pierre Lesueur (known as DarkCoderSc), an independent programmer and computer security coder from the United Kingdom. Although the RAT was developed back in 2008, it began to proliferate at the start of 2012.",
"meta": {
"date": "2008",
"refs": [
"https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/",
"https://blogs.cisco.com/security/talos/darkkomet-rat-spam"
],
"synonyms": [
"Dark Comet"
]
},
"related": [
{
"dest-uuid": "9ad11139-e928-45cf-a0b4-937290642e92",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "5086a6e0-53b2-4d96-9eb3-a0237da2e591",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
}
],
"uuid": "8a21ae06-d257-48a0-989b-1c9aebedabc2",
"value": "DarkComet"
},
{
"description": "Backdoor.Lanfiltrator is a backdoor Trojan that gives an attacker unauthorized access to a compromised computer. The detection is used for a family of Trojans that are produced by the Backdoor.Lanfiltrator generator.",
"meta": {
"date": "2002",
"refs": [
"https://www.symantec.com/security_response/writeup.jsp?docid=2002-121116-0350-99"
]
},
"uuid": "826e73f8-2241-4c99-848d-8597d685cfd3",
"value": "Lanfiltrator"
},
{
"description": "Win32.HsIdir is an advanced remote administrator tool systems was done by the original author HS32-Idir, it is the development of the release made since 2006 Copyright © 2006-2010 HS32-Idir.",
"meta": {
"refs": [
"http://lexmarket.su/thread-27692.html",
"https://www.nulled.to/topic/129749-win32hsidir-rat/"
]
},
"uuid": "569d539f-f949-4156-8896-108ea8352fbc",
"value": "Win32.HsIdir"
},
{
"description": "Optix Pro is a configurable remote access tool or Trojan, similar to SubSeven or BO2K",
"meta": {
"date": "2002",
"refs": [
"https://en.wikipedia.org/wiki/Optix_Pro",
"https://www.symantec.com/security_response/writeup.jsp?docid=2002-090416-0521-99",
"https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=20208"
]
},
"uuid": "4ce3247b-203a-42a8-aaa0-05558c50894e",
"value": "Optix Pro"
},
{
"description": "Back Orifice 2000 (often shortened to BO2k) is a computer program designed for remote system administration. It enables a user to control a computer running the Microsoft Windows operating system from a remote location. The name is a pun on Microsoft BackOffice Server software. Back Orifice 2000 is a new version of the famous Back Orifice backdoor trojan (hacker's remote access tool). It was created by the Cult of Dead Cow hackers group in July 1999. Originally the BO2K was released as a source code and utilities package on a CD-ROM. There are reports that some files on that CD-ROM were infected with CIH virus, so the people who got that CD might get infected and spread not only the compiled backdoor, but also the CIH virus. ",
"meta": {
"date": "1998",
"refs": [
"https://en.wikipedia.org/wiki/Back_Orifice_2000",
"https://home.mcafee.com/VirusInfo/VirusProfile.aspx?key=10229",
"https://www.symantec.com/security_response/writeup.jsp?docid=2000-121814-5417-99",
"https://www.f-secure.com/v-descs/bo2k.shtml"
],
"synonyms": [
"BO2k"
]
},
"uuid": "91f8a1d8-c816-45e1-8c26-17a7305ca375",
"value": "Back Orifice 2000"
},
{
"description": "The software consists of a server and client application for the Virtual Network Computing (VNC) protocol to control another ",
"meta": {
"refs": [
"https://www.realvnc.com/"
],
"synonyms": [
"VNC Connect",
"VNC Viewer"
]
},
"uuid": "e1290288-84d4-4b32-858d-db4ed612de44",
"value": "RealVNC"
},
{
"description": "Backdoor:Java/Adwind is a Java archive (.JAR) file that drops a malicious component onto the machines and runs as a backdoor. When active, it is capable of stealing user information and may also be used to distribute other malware. ",
"meta": {
"date": "2011",
"refs": [
"https://securelist.com/securelist/files/2016/02/KL_AdwindPublicReport_2016.pdf",
"https://www.f-secure.com/v-descs/backdoor_java_adwind.shtml",
"https://blog.fortinet.com/2016/08/16/jbifrost-yet-another-incarnation-of-the-adwind-rat",
"https://www.ncsc.gov.uk/content/files/protected_files/article_files/Joint%20report%20on%20publicly%20available%20hacking%20tools%20%28NCSC%29.pdf"
],
"synonyms": [
"UNRECOM",
"UNiversal REmote COntrol Multi-Platform",
"Frutas",
"AlienSpy",
"Unrecom",
"Jsocket",
"JBifrost"
]
},
"related": [
{
"dest-uuid": "ab4694d6-7043-41f2-b328-d93bec9c1b22",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "ce1a9641-5bb8-4a61-990a-870e9ef36ac1",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "dadccdda-a4c2-4021-90b9-61a394e602be",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "8eb9d4aa-257a-45eb-8c65-95c18500171c",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
}
],
"uuid": "b76d9845-815c-4e77-9538-6b737269da2f",
"value": "Adwind RAT"
},
{
"meta": {
"refs": [
"https://www.virustotal.com/en/file/b31812e5b4c63c5b52c9b23e76a5ea9439465ab366a9291c6074bfae5c328e73/analysis/1359376345/"
]
},
"uuid": "eff22ed3-81fc-4055-bd1d-76e1f191f487",
"value": "Albertino Advanced RAT"
},
{
"description": "The malware is a Remote Access Trojan (RAT), known as Arcom RAT, and it is sold on underground forums for $2000.00.",
"meta": {
"refs": [
"https://www.symantec.com/security_response/writeup.jsp?docid=2012-112912-5237-99",
"http://blog.trendmicro.com/trendlabs-security-intelligence/tsunami-warning-leads-to-arcom-rat/"
]
},
"uuid": "cd167b01-dc63-4576-b4a1-5ee707aa392b",
"value": "Arcom"
},
{
"description": "BlackNix rat is a rat coded in delphi. ",
"meta": {
"refs": [
"https://leakforums.net/thread-18123?tid=18123&&pq=1"
]
},
"uuid": "f3e79212-0e35-40d2-a1d6-37b629a8138e",
"value": "BlackNix"
},
{
"description": "Blue Banana is a RAT (Remote Administration Tool) created purely in Java",
"meta": {
"date": "2012",
"refs": [
"https://leakforums.net/thread-123872",
"https://techanarchy.net/2014/02/blue-banana-rat-config/"
]
},
"uuid": "9b515229-36f6-4b93-9889-36116a12fd74",
"value": "Blue Banana"
},
{
"description": "Bozok, like many other popular RATs, is freely available. The author of the Bozok RAT goes by the moniker “Slayer616” and has created another RAT known as Schwarze Sonne, or “SS-RAT” for short. Both of these RATs are free and easy to find — various APT actors have used both in previous targeted attacks.",
"meta": {
"date": "2013",
"refs": [
"https://www.fireeye.com/blog/threat-research/2013/10/know-your-enemy-tracking-a-rapidly-evolving-apt-actor.html"
]
},
"related": [
{
"dest-uuid": "f9d0e934-879c-4668-b959-6bf7bdc96f5d",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
}
],
"uuid": "41f45758-0376-42a8-bc07-8f2ffbee3ad2",
"value": "Bozok"
},
{
"description": "ClientMesh is a Remote Administration Application yhich allows a user to control a number of client PCs from around the world.",
"meta": {
"refs": [
"https://sinister.ly/Thread-ClientMesh-RAT-In-Built-FUD-Crypter-Stable-DDoSer-No-PortForwading-40-Lifetime",
"https://blog.yakuza112.org/2012/clientmesh-rat-v5-cracked-clean/"
]
},
"uuid": "03eb6742-9a17-4aed-95e4-d8a0b0abefc3",
"value": "ClientMesh"
},
{
"description": "CyberGate is a powerful, fully configurable and stable Remote Administration Tool coded in Delphi that is continuously getting developed. Using cybergate you can log the victim's passwords and can also get the screen shots of his computer's screen.",
"meta": {
"date": "2011",
"refs": [
"http://www.hackersthirst.com/2011/03/cybergate-rat-hacking-facebook-twitter.html",
"http://www.nbcnews.com/id/41584097/ns/technology_and_science-security/t/cybergate-leaked-e-mails-hint-corporate-hacking-conspiracy/"
]
},
"related": [
{
"dest-uuid": "062d8577-d6e6-4c97-bcac-eb6eb1a50a8d",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
}
],
"uuid": "c3cf4e88-704b-4d7c-8185-ee780804f3d3",
"value": "CyberGate"
},
{
"meta": {
"refs": [
"http://meinblogzumtesten.blogspot.lu/2013/05/dark-ddoser-v56c-cracked.html"
]
},
"uuid": "3c026104-6129-4749-9b41-07c28d9e84c4",
"value": "Dark DDoSeR"
},
{
"description": "In March 2017, Fujitsu Cyber Threat Intelligence uncovered a newly developed remote access tool referred to by its developer as ‘Dark RAT’ – a tool used to steal sensitive information from victims. Offered as a Fully Undetectable build (FUD) the RAT has a tiered price model including 24/7 support and an Android version. Android malware has seen a significant rise in interest and in 2015 this resulted in the arrests of a number of suspects involved in the infamous DroidJack malware.",
"meta": {
"date": "2005",
"refs": [
"https://www.infosecurity-magazine.com/blogs/the-dark-rat/",
"http://darkratphp.blogspot.lu/"
],
"synonyms": [
"DarkRAT"
]
},
"uuid": "7135cc9c-a7bf-44fc-b74b-80de9edd9438",
"value": "DarkRat"
},
{
"meta": {
"refs": [
"https://sites.google.com/site/greymecompany/greame-rat-project"
]
},
"uuid": "e880a029-bb01-4a64-baa3-b13fc2af4e9d",
"value": "Greame"
},
{
"description": "HawkEye is a popular RAT that can be used as a keylogger, it is also able to identify login events and record the destination, username, and password.",
"meta": {
"date": "2003",
"refs": [
"http://securityaffairs.co/wordpress/54837/hacking/one-stop-shop-hacking.html",
"https://www.bleepingcomputer.com/news/security/zoho-heavily-used-by-keyloggers-to-transmit-stolen-data/"
]
},
"uuid": "8414f79c-a879-44b6-b154-4992aa12dff1",
"value": "HawkEye"
},
{
"description": "jRAT is the cross-platform remote administrator tool that is coded in Java, Because its coded in Java it gives jRAT possibilities to run on all operation systems, Which includes Windows, Mac OSX and Linux distributions.",
"meta": {
"date": "2012",
"refs": [
"https://www.rekings.com/shop/jrat/"
],
"synonyms": [
"JacksBot"
]
},
"related": [
{
"dest-uuid": "f2a9f583-b4dd-4669-8808-49c8bbacc376",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
}
],
"uuid": "1df62d96-88f8-473c-94a2-252eb360ba62",
"value": "jRAT"
},
{
"description": "jSpy is a Java RAT. ",
"meta": {
"date": "2013",
"refs": [
"https://leakforums.net/thread-479505"
]
},
"related": [
{
"dest-uuid": "ff24997d-1f17-4f00-b9b8-b3392146540f",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
}
],
"uuid": "669a0e4d-9760-49fc-bdf5-0471f84e0c76",
"value": "jSpy"
},
{
"description": "Just saying that this is a very badly coded RAT by the biggest skid in this world, that is XilluX. The connection is very unstable, the GUI is always flickering because of the bad Multi-Threading and many more bugs.",
"meta": {
"refs": [
"https://leakforums.net/thread-284656"
]
},
"uuid": "aad1038d-4d50-4a3e-88f3-cd9d154dc45c",
"value": "LuxNET"
},
{
"description": "NJRat is a remote access trojan (RAT), first spotted in June 2013 with samples dating back to November 2012. It was developed and is supported by Arabic speakers and mainly used by cybercrime groups against targets in the Middle East. In addition to targeting some governments in the region, the trojan is used to control botnets and conduct other typical cybercrime activity. It infects victims via phishing attacks and drive-by downloads and propagates through infected USB keys or networked drives. It can download and execute additional malware, execute shell commands, read and write registry keys, capture screenshots, log keystrokes, and spy on webcams.",
"meta": {
"date": "2012",
"refs": [
"https://www.cyber.nj.gov/threat-profiles/trojan-variants/njrat"
],
"synonyms": [
"Njw0rm"
]
},
"related": [
{
"dest-uuid": "c01ef312-dfd6-403f-a8b5-67fc11a550a7",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
}
],
"uuid": "7fb493bb-756b-42a2-8f6d-59e254f4f2cc",
"value": "NJRat"
},
{
"description": "Remote administrator tool that has been developed for Windows operation system. With advanced features and stable structure, Pandora’s structure is based on advanced client / server architecture. was configured using modern technology.",
"meta": {
"date": "2002",
"refs": [
"https://www.rekings.com/pandora-rat-2-2/"
]
},
"uuid": "59485642-d233-4167-9f51-bd1d74285c23",
"value": "Pandora"
},
{
"description": "Unlike Zeus, Predator Pain and Limitless are relatively simple keyloggers. They indiscriminately steal web credentials and mail client credentials, as well as capturing keystrokes and screen captures. The output is human readable, which is good if you are managing a few infected machines only, but the design doesn’t scale well when there are a lot of infected machines and logs involved.",
"meta": {
"refs": [
"http://blog.trendmicro.com/trendlabs-security-intelligence/predator-pain-and-limitless-behind-the-fraud/",
"https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-predator-pain-and-limitless.pdf"
],
"synonyms": [
"PredatorPain"
]
},
"related": [
{
"dest-uuid": "31615066-dbff-4134-b467-d97a337b408b",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
}
],
"uuid": "42a97a5d-ee33-492a-b20f-758ecdbf1aed",
"value": "Predator Pain"
},
{
"description": "Remote administration tool",
"meta": {
"date": "2007",
"refs": [
"http://punisher-rat.blogspot.lu/"
]
},
"uuid": "e49af83c-fd2f-4540-92dc-97c7b84a9458",
"value": "Punisher RAT"
},
{
"description": "This is tool that allow you to control your computer form anywhere in world with full support to unicode language. ",
"meta": {
"refs": [
"https://www.rekings.com/spygate-rat-3-2/",
"https://www.symantec.com/security_response/attacksignatures/detail.jsp%3Fasid%3D27950",
"http://spygate-rat.blogspot.lu/"
]
},
"uuid": "1c3df89a-1f30-4ccb-acb4-5dee4b470b55",
"value": "SpyGate"
},
{
"description": "RAT",
"meta": {
"refs": [
"http://small-net-rat.blogspot.lu/"
],
"synonyms": [
"SmallNet"
]
},
"uuid": "1dd0c7f8-a6fb-4912-9de9-deb43f384fdb",
"value": "Small-Net"
},
{
"description": "Vantom is a free RAT with good option and very stable.",
"meta": {
"refs": [
"https://www.rekings.com/vantom-rat/"
]
},
"uuid": "6e5a1fcb-f730-4d8d-890a-ef133782a7d2",
"value": "Vantom"
},
{
"description": "Xena RAT is a fully-functional, stable, state-of-the-art RAT, coded in a native language called Delphi, it has almost no dependencies.",
"meta": {
"refs": [
"https://leakforums.net/thread-497480"
]
},
"uuid": "b9d5ab11-dd6f-49ba-8117-ce16f71ff11c",
"value": "Xena"
},
{
"description": "This malware has been used in targeted attacks as well as traditional cybercrime. During our investigation we found that the majority of XtremeRAT activity is associated with spam campaigns that typically distribute Zeus variants and other banking-focused malware. ",
"meta": {
"date": "2010",
"refs": [
"https://www.fireeye.com/blog/threat-research/2014/02/xtremerat-nuisance-or-threat.html"
]
},
"uuid": "3b6b55fb-595c-40c5-bbc5-dbe244b15026",
"value": "XtremeRAT"
},
{
"description": "NetWire has a built-in keylogger that can capture inputs from peripheral devices such as USB card readers.",
"meta": {
"date": "2012",
"refs": [
"https://www.secureworks.com/blog/netwire-rat-steals-payment-card-data"
]
},
"uuid": "e3113a0e-a65b-4119-8bc2-1c8d9d18c2db",
"value": "Netwire"
},
{
"description": "Gh0st RAT is a Trojan horse for the Windows platform that the operators of GhostNet used to hack into some of the most sensitive computer networks on Earth. It is a cyber spying computer program. .",
"meta": {
"date": "2001",
"refs": [
"https://www.volexity.com/blog/2017/03/23/have-you-been-haunted-by-the-gh0st-rat-today/"
]
},
"related": [
{
"dest-uuid": "225fa6cf-dc9c-4b86-873b-cdf1d9dd3738",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "c82c904f-b3b4-40a2-bf0d-008912953104",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "used-by"
}
],
"uuid": "255a59a7-db2d-44fc-9ca9-5859b65817c3",
"value": "Gh0st RAT"
},
{
"description": "Plasma RAT’s stub is fairly advanced, having many robust features. Some of the features include botkilling, Cryptocurrencies Mining (CPU and GPU), persistence, anti-analysis, torrent seeding, AV killer, 7 DDoS methods and a keylogger. The RAT is coded in VB.Net. There is also a Botnet version of it (Plasma HTTP), which is pretty similar to the RAT version.",
"meta": {
"refs": [
"http://www.zunzutech.com/blog/security/analysis-of-plasma-rats-source-code/"
]
},
"uuid": "af534ddb-d0c6-47c0-82be-058c8bd5c6e1",
"value": "Plasma RAT"
},
{
"description": "Babylon is a highly advanced remote administration tool with no dependencies. The server is developed in C++ which is an ideal language for high performance and the client is developed in C#(.Net Framework 4.5)",
"meta": {
"refs": [
"https://www.rekings.com/babylon-rat/"
]
},
"uuid": "ad1c9a50-3cd2-446a-ab31-9ecb62980d61",
"value": "Babylon"
},
{
"description": "RAT",
"meta": {
"refs": [
"http://www.imminentmethods.info/"
]
},
"uuid": "f52a5252-ef53-4935-81c8-96fffcd1b952",
"value": "Imminent Monitor"
},
{
"description": "DroidJack is a RAT (Remote Access Trojan/Remote Administration Tool) nature of remote accessing, monitoring and managing tool (Java based) for Android mobile OS. You can use it to perform a complete remote control to any Android devices infected with DroidJack through your PC. It comes with powerful function and user-friendly operation – even allows attackers to fully take over the mobile phone and steal, record the victim’s private data wilfully.",
"meta": {
"refs": [
"http://droidjack.net/"
]
},
"uuid": "7f032293-bfa2-4595-803d-c84519190861",
"value": "DroidJack"
},
{
"description": "Quasar is a fast and light-weight remote administration tool coded in C#. Providing high stability and an easy-to-use user interface",
"meta": {
"date": "2014",
"refs": [
"https://github.com/quasar/QuasarRAT",
"https://researchcenter.paloaltonetworks.com/2017/10/unit42-tracking-subaat-targeted-phishing-attacks-point-leader-threat-actors-repository/",
"https://www.ncsc.gov.uk/content/files/protected_files/article_files/Joint%20report%20on%20publicly%20available%20hacking%20tools%20%28NCSC%29.pdf"
]
},
"related": [
{
"dest-uuid": "05252643-093b-4070-b62f-d5836683a9fa",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
}
],
"uuid": "6efa425c-3731-44fd-9224-2a62df061a2d",
"value": "Quasar RAT"
},
{
"description": "Dendroid is malware that affects Android OS and targets the mobile platform. It was first discovered in early of 2014 by Symantec and appeared in the underground for sale for $300. Some things were noted in Dendroid, such as being able to hide from emulators at the time. When first discovered in 2014 it was one of the most sophisticated Android remote administration tools known at that time. It was one of the first Trojan applications to get past Google's Bouncer and caused researchers to warn about it being easier to create Android malware due to it. It also seems to have follow in the footsteps of Zeus and SpyEye by having simple-to-use command and control panels. The code appeared to be leaked somewhere around 2014. It was noted that an apk binder was included in the leak, which provided a simple way to bind Dendroid to legitimate applications.",
"meta": {
"date": "2014",
"refs": [
"https://github.com/qqshow/dendroid",
"https://github.com/nyx0/Dendroid"
]
},
"related": [
{
"dest-uuid": "317a2c10-d489-431e-b6b2-f0251fddc88e",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
}
],
"uuid": "ea3a8c25-4adb-4538-bf11-55259bdba15f",
"value": "Dendroid"
},
{
"description": "A Java R.A.T. program",
"meta": {
"date": "2016",
"refs": [
"https://github.com/shotskeber/Ratty"
]
},
"related": [
{
"dest-uuid": "da032a95-b02a-4af2-b563-69f686653af4",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
}
],
"uuid": "a51f07ae-ab2c-45ee-aa9c-1db7873e7bb4",
"value": "Ratty"
},
{
"description": "Java RAT",
"meta": {
"refs": [
"http://level23hacktools.com/forum/showthread.php?t=27971",
"https://leakforums.net/thread-405562?tid=405562&&pq=1"
]
},
"uuid": "48b6886b-67a9-4815-92a2-1b7aca24d4ac",
"value": "RaTRon"
},
{
"meta": {
"date": "2006",
"refs": [
"http://arabian-attacker.software.informer.com/"
]
},
"uuid": "f966a936-19f9-4b6b-95b3-0ff102e26303",
"value": "Arabian-Attacker RAT"
},
{
"description": "Androrat is a client/server application developed in Java Android for the client side and in Java/Swing for the Server.",
"meta": {
"refs": [
"https://latesthackingnews.com/2015/05/31/how-to-hack-android-phones-with-androrat/",
"https://github.com/wszf/androrat"
]
},
"uuid": "ce70bf96-0629-4c7d-8ed8-2315fab0ed42",
"value": "Androrat"
},
{
"description": "Remote Administrator",
"meta": {
"refs": [
"http://adzok.com/"
]
},
"uuid": "3560c833-3d28-4888-b0b8-1951ecac57a2",
"value": "Adzok"
},
{
"meta": {
"date": "2010",
"refs": [
"https://github.com/mwsrc/Schwarze-Sonne-RAT"
],
"synonyms": [
"SS-RAT",
"Schwarze Sonne"
]
},
"uuid": "99860df7-565d-47e4-a086-c4af1623b626",
"value": "Schwarze-Sonne-RAT"
},
{
"meta": {
"refs": [
"https://www.indetectables.net/viewtopic.php?t=24245"
]
},
"uuid": "729f1b02-ce0c-41a4-8d4e-c7c1f5475c4b",
"value": "Cyber Eye RAT"
},
{
"uuid": "9501172b-a81a-49bb-90ce-31f2fb78a130",
"value": "Batch NET"
},
{
"meta": {
"refs": [
"https://leakforums.net/thread-530663"
]
},
"uuid": "62c5b489-8750-4fab-aca3-b233af789831",
"value": "RWX RAT"
},
{
"description": "Spy-Net is a software that allow you to control any computer in world using Windows Operating System.He is back using new functions and good options to give you full control of your remote computer.Stable and fast, this software offer to you a good interface, creating a easy way to use all his functions",
"meta": {
"date": "2010",
"refs": [
"http://spynet-rat-officiel.blogspot.lu/"
]
},
"uuid": "66bfd62e-6626-4104-af37-a44244204ac8",
"value": "Spynet"
},
{
"meta": {
"refs": [
"https://leakforums.net/thread-559871"
]
},
"uuid": "b9d7d5b8-7cf4-4650-a88a-5f4e991c45d6",
"value": "CTOS"
},
{
"meta": {
"refs": [
"https://github.com/mwsrc/Virus-RAT-v8.0-Beta"
]
},
"uuid": "9107fc0d-6705-4fc2-b621-e5ac42afef90",
"value": "Virus RAT"
},
{
"meta": {
"refs": [
"http://www.atelierweb.com/products/"
]
},
"uuid": "c51188d6-d489-4a18-a9a8-e38365f0bc10",
"value": "Atelier Web Remote Commander"
},
{
"description": "A distributed, parallelized (Map Reduce) wrapper around Apache™ RAT to allow it to complete on large code repositories of multiple file types where Apache™ RAT hangs forev",
"meta": {
"refs": [
"https://github.com/chrismattmann/drat"
]
},
"uuid": "5ee39172-7ba3-477c-9772-88841b4be691",
"value": "drat"
},
{
"description": "MoSucker is a powerful backdoor - hacker's remote access tool.",
"meta": {
"refs": [
"https://www.f-secure.com/v-descs/mosuck.shtml"
]
},
"uuid": "611ed43b-b869-4419-a487-6f7393125eb3",
"value": "MoSucker"
},
{
"meta": {
"date": "2002",
"refs": [
"http://www.grayhatforum.org/thread-4373-post-5213.html#pid5213",
"http://www.spy-emergency.com/research/T/Theef_Download_Creator.html",
"http://www.spy-emergency.com/research/T/Theef.html"
]
},
"uuid": "f5154f40-46c1-4a0d-9814-cb5e5adf201b",
"value": "Theef"
},
{
"description": "ProRat is a Microsoft Windows based backdoor trojan, more commonly known as a Remote Administration Tool. As with other trojan horses it uses a client and server. ProRat opens a port on the computer which allows the client to perform numerous operations on the server (the machine being controlled). ",
"meta": {
"date": "2002",
"refs": [
"http://prorat.software.informer.com/",
"http://malware.wikia.com/wiki/ProRat"
]
},
"uuid": "cae67963-63d2-4c8b-8358-a03556f20b7b",
"value": "ProRat"
},
{
"meta": {
"refs": [
"https://sites.google.com/site/greymecompany/setro-rat-project"
]
},
"uuid": "6b1b2415-b42f-41c4-8c35-077844a9c4dc",
"value": "Setro"
},
{
"meta": {
"refs": [
"http://www.connect-trojan.net/2015/03/indetectables-rat-v.0.5-beta.html"
]
},
"uuid": "36912ecf-9411-44fa-b14d-ec3b6896b0e2",
"value": "Indetectables RAT"
},
{
"meta": {
"refs": [
"https://luminosity.link/"
]
},
"uuid": "0f2c6cd4-675a-4c41-acf5-1b0bc3625375",
"value": "Luminosity Link"
},
{
"meta": {
"date": "2015",
"refs": [
"https://orcustechnologies.com/"