InnaputRAT
InnaputRAT is a remote access tool that can exfiltrate files from a victim’s machine. InnaputRAT has been seen out in the wild since 2016. [1]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1036 | .004 | 伪装: Masquerade Task or Service |
InnaputRAT variants have attempted to appear legitimate by adding a new service named OfficeUpdateService.[1] |
| .005 | 伪装: Match Legitimate Name or Location |
InnaputRAT variants have attempted to appear legitimate by using the file names SafeApp.exe and NeutralApp.exe.[1] |
||
| Enterprise | T1543 | .003 | 创建或修改系统进程: Windows Service |
Some InnaputRAT variants create a new Windows service to establish persistence.[1] |
| Enterprise | T1547 | .001 | 启动或登录自动启动执行: Registry Run Keys / Startup Folder |
Some InnaputRAT variants establish persistence by modifying the Registry key |
| Enterprise | T1059 | .003 | 命令与脚本解释器: Windows Command Shell |
InnaputRAT launches a shell to execute commands on the victim’s machine.[1] |
| Enterprise | T1083 | 文件和目录发现 |
InnaputRAT enumerates directories and obtains file attributes on a system.[1] |
|
| Enterprise | T1106 | 本机API |
InnaputRAT uses the API call ShellExecuteW for execution.[1] |
|
| Enterprise | T1027 | 混淆文件或信息 |
InnaputRAT uses an 8-byte XOR key to obfuscate API names and other strings contained in the payload.[1] |
|
| Enterprise | T1070 | .004 | 移除指标: File Deletion |
InnaputRAT has a command to delete files.[1] |
| Enterprise | T1082 | 系统信息发现 |
InnaputRAT gathers volume drive information and system information.[1] |
|