Skip to content

S0235 CrossRAT

CrossRAT is a cross platform RAT.

Item Value
ID S0235
Associated Names
Type MALWARE
Version 1.1
Created 17 October 2018
Last Modified 30 March 2020
Navigation Layer View In ATT&CK® Navigator

Techniques Used

Domain ID Name Use
enterprise T1547 Boot or Logon Autostart Execution -
enterprise T1547.001 Registry Run Keys / Startup Folder CrossRAT uses run keys for persistence on Windows
enterprise T1543 Create or Modify System Process -
enterprise T1543.001 Launch Agent CrossRAT creates a Launch Agent on macOS.1
enterprise T1083 File and Directory Discovery CrossRAT can list all files on a system.
enterprise T1113 Screen Capture CrossRAT is capable of taking screen captures.1

Groups That Use This Software

ID Name References
G0070 Dark Caracal 1

References