S0235 CrossRAT
CrossRAT is a cross platform RAT.
| Item | Value |
|---|---|
| ID | S0235 |
| Associated Names | |
| Type | MALWARE |
| Version | 1.2 |
| Created | 17 October 2018 |
| Last Modified | 28 September 2023 |
| Navigation Layer | View In ATT&CK® Navigator |
Techniques Used
| Domain | ID | Name | Use |
|---|---|---|---|
| enterprise | T1547 | Boot or Logon Autostart Execution | - |
| enterprise | T1547.001 | Registry Run Keys / Startup Folder | CrossRAT uses run keys for persistence on Windows.1 |
| enterprise | T1547.013 | XDG Autostart Entries | CrossRAT can use an XDG Autostart to establish persistence.2 |
| enterprise | T1543 | Create or Modify System Process | - |
| enterprise | T1543.001 | Launch Agent | CrossRAT creates a Launch Agent on macOS.1 |
| enterprise | T1083 | File and Directory Discovery | CrossRAT can list all files on a system.1 |
| enterprise | T1113 | Screen Capture | CrossRAT is capable of taking screen captures.1 |
Groups That Use This Software
| ID | Name | References |
|---|---|---|
| G0070 | Dark Caracal | 1 |