Skip to content

S0506 ViperRAT

ViperRAT is sophisticated surveillanceware that has been in operation since at least 2015 and was used to target the Israeli Defense Force.1

Item Value
ID S0506
Associated Names
Type MALWARE
Version 1.0
Created 11 September 2020
Last Modified 29 September 2020
Navigation Layer View In ATT&CK® Navigator

Techniques Used

Domain ID Name Use
mobile T1429 Audio Capture ViperRAT can collect and record audio content.1
mobile T1533 Data from Local System ViperRAT can collect device photos, PDF documents, Office documents, browser history, and browser bookmarks.1
mobile T1407 Download New Code at Runtime ViperRAT has been installed in two stages and can secretly install new applications.1
mobile T1430 Location Tracking ViperRAT can track the device’s location.1
mobile T1636 Protected User Data -
mobile T1636.002 Call Log ViperRAT can collect the device’s call log.1
mobile T1636.003 Contact List ViperRAT can collect the device’s contact list.1
mobile T1636.004 SMS Messages ViperRAT can collect SMS messages.1
mobile T1426 System Information Discovery ViperRAT can collect system information, including brand, manufacturer, and serial number.1
mobile T1422 System Network Configuration Discovery ViperRAT can collect network configuration data from the device, including phone number, SIM operator, and network operator.1
mobile T1421 System Network Connections Discovery ViperRAT can collect the device’s cell tower information.1
mobile T1512 Video Capture ViperRAT can take photos with the device camera.1

References

  1. M. Flossman. (2017, February 16). ViperRAT: The mobile APT targeting the Israeli Defense Force that should be on your radar. Retrieved September 11, 2020. ↩↩↩↩↩↩↩↩↩↩↩↩