SombRAT

SombRAT has collected data and files from a compromised host.

SombRAT can enumerate services on a victim machine.

SombRAT can encrypt strings with XOR-based routines and use a custom AES storage format for plugins, configuration, C2 domains, and harvested data.

SombRAT can execute getinfo to identify the username on a compromised host.

SombRAT can use a legitimate process name to hide itself.

SombRAT has uploaded collected data and files from a compromised host to its C2 server.

SombRAT can execute loadfromfile, loadfromstorage, and loadfrommem to inject a DLL from disk, storage, or memory respectively.

SombRAT can use the getprocesslist command to enumerate processes on a compromised host.

SombRAT has the ability to run cancel or closeanddeletestorage to remove all files from storage and delete the storage temp file on a compromised host.

SombRAT can communicate over DNS with the C2 server.

SombRAT can store harvested data in a custom database under the %TEMP% directory.

SombRAT can execute getinfo to enumerate the computer name and OS version of a compromised system.

SombRAT can execute enum to enumerate files in storage on a compromised system.

SombRAT has the ability to use an embedded SOCKS proxy in C2 communications.

SombRAT has the ability to use TCP sockets to send data and ICMP to ping the C2 server.