Academy
TermMalware type

Remote Access Trojan

(RAT)

Malware that gives the attacker remote and continuous control over the infected device.

Flow

  1. 1Installed
  2. 2Connects
  3. 3Takes commands
Related families
DarkCrystal RAT (DCRat)
MITRE ATT&CK
T1219 · Remote Access Tools
Sources
5 sources
01

Overview

An infostealer takes the data and leaves; a RAT stays. The attacker manages files, runs commands, watches the screen, records keystrokes and downloads new payloads at will. MITRE ATT&CK

Many RATs also carry infostealer modules; the distinction lies less in the number of functions than in persistence and interaction. Zscaler

02

How it works

  1. 1

    Installed

    The loader downloads the RAT and registers it to run at startup. MITRE ATT&CK

  2. 2

    Connects

    It establishes a persistent connection with the command and control server. MITRE ATT&CK

  3. 3

    Takes commands

    From the panel, the attacker uses file, screen, keylogging and shell access. MITRE ATT&CK

03

Real-world examples

DCRat: a government institution in Colombia

DarkCrystal RAT (DCRat) profile

Zscaler documented that BlindEagle installed DCRat in the final stage with the Caminho downloader, and that DCRat is an open-source RAT written in C# offering keylogging and disk access. Zscaler

04

How to detect it

  • Unsigned programs added to startup keys and connections going to a single server at regular intervals. MITRE ATT&CK
05

What to do

  • Restrict remote access tools with an allowlist; block unapproved ones. MITRE ATT&CK
06

MITRE ATT&CK

07

Related families and terms

08

Sources

  1. 1Remote Access Tools (T1219) · MITRE ATT&CK
  2. 2Registry Run Keys / Startup Folder (T1547.001) · MITRE ATT&CK
  3. 3Web Protocols (T1071.001) · MITRE ATT&CK
  4. 4BlindEagle targets Colombian government agency with Caminho and DCRat · Zscaler
  5. 5Behavior Prevention on Endpoint (M1040) · MITRE ATT&CK
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.