1. Home
  2. Software
  3. RATANKBA

RATANKBA

RATANKBA is a remote controller tool used by Lazarus Group. RATANKBA has been used in attacks targeting financial institutions in Poland, Mexico, Uruguay, the United Kingdom, and Chile. It was also seen used against organizations related to telecommunications, management consulting, information technology, insurance, aviation, and education. RATANKBA has a graphical user interface to allow the attacker to issue jobs to perform on the infected machines. [1] [2]

ID: S0241
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.1
Created: 17 October 2018
Last Modified: 02 September 2020
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1047 Windows管理规范

RATANKBA uses WMI to perform process monitoring.[1][2]
Enterprise T1059 .001 命令与脚本解释器: PowerShell

There is a variant of RATANKBA that uses a PowerShell script instead of the traditional PE form.[1][2]
.003 命令与脚本解释器: Windows Command Shell

RATANKBA uses cmd.exe to execute commands.[1][2]
Enterprise T1071 .001 应用层协议: Web Protocols

RATANKBA uses HTTP/HTTPS for command and control communication.[1][2]
Enterprise T1012 查询注册表

RATANKBA uses the command reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings".[2]
Enterprise T1082 系统信息发现

RATANKBA gathers information about the OS architecture, OS name, and OS version/Service pack.[1][2]
Enterprise T1033 系统所有者/用户发现

RATANKBA runs the whoami and query user commands.[2]
Enterprise T1007 系统服务发现

RATANKBA uses tasklist /svc to display running tasks.[2]
Enterprise T1049 系统网络连接发现

RATANKBA uses netstat -ano to search for specific IP address ranges.[2]
Enterprise T1016 系统网络配置发现

RATANKBA gathers the victim’s IP address via the ipconfig -all command.[1][2]
Enterprise T1087 .001 账号发现: Local Account

RATANKBA uses the net user command.[2]
Enterprise T1105 输入工具传输

RATANKBA uploads and downloads information.[1][2]
Enterprise T1057 进程发现

RATANKBA lists the system’s processes.[1][2]
Enterprise T1055 .001 进程注入: Dynamic-link Library Injection

RATANKBA performs a reflective DLL injection using a given pid.[1][2]
Enterprise T1018 远程系统发现

RATANKBA runs the net view /domain and net view commands.[2]

Groups That Use This Software

ID Name References
G0032 Lazarus Group

[1]

References

  1. Lei, C., et al. (2018, January 24). Lazarus Campaign Targeting Cryptocurrencies Reveals Remote Controller Tool, an Evolved RATANKBA, and More. Retrieved May 22, 2018.
  1. Trend Micro. (2017, February 27). RATANKBA: Delving into Large-scale Watering Holes against Enterprises. Retrieved May 22, 2018.