Talos PoetRAT April 2020

PoetRAT used voStro.exe, a compiled pypykatz (Python version of Mimikatz), to steal credentials.

PoetRAT used Nmap for remote system discovery.

PoetRAT has used a custom encryption scheme for communication between scripts.

PoetRAT sent username, computer name, and the previously generated UUID in reply to a "who" command from C2.

PoetRAT has used a .NET tool named dog.exe to exiltrate information over an e-mail account.

PoetRAT has used ftp for exfiltration.

PoetRAT has used a Python tool named klog.exe for keylogging.

PoetRAT has the ability to list all running processes.

PoetRAT has used Word documents with VBScripts to execute malicious activities.

PoetRAT was executed with a Python script and worked in conjunction with additional Python-based post-exploitation tools.

PoetRAT has the ability to overwrite scripts and delete itself if a sandbox environment is detected.

PoetRAT has the ability to gather information about the compromised host.

PoetRAT has the ability to list files upon receiving the ls command from C2.

PoetRAT has the ability to copy files and download/upload files into C2 channels using FTP and HTTPS.

PoetRAT has made registry modifications to alter its behavior upon execution.

PoetRAT has the ability to take screen captures.

PoetRAT used file system monitoring to track modification and enable automatic exfiltration.

PoetRAT has used a Python tool named Bewmac to record the webcam on compromised hosts.

PoetRAT has used spearphishing attachments to infect victims.

PoetRAT checked the size of the hard drive to determine if it was being run in a sandbox environment. In the event of sandbox detection, it would delete itself by overwriting the malware scripts with the contents of "License.txt" and exiting.

PoetRAT has added a registry key in the <RUN> hive for persistence.

PoetRAT has used a Python tool named Browdec.exe to steal browser credentials.

PoetRAT was delivered with documents using DDE to execute malicious code.

PoetRAT has the ability to compress files with zip.

PoetRAT has the ability to hide and unhide files.

PoetRAT was distributed via malicious Word documents.

PoetRAT used TLS to encrypt communications over port 143

PoetRAT used TLS to encrypt command and control (C2) communications.