1. Home
  2. Software
  3. SQLRat

SQLRat

SQLRat is malware that executes SQL scripts to avoid leaving traditional host artifacts. FIN7 has been observed using it.[1]

ID: S0390
ⓘ
Type: MALWARE
Version: 1.2
Created: 18 June 2019
Last Modified: 22 March 2023
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1140 反混淆/解码文件或信息

SQLRat has scripts that are responsible for deobfuscating additional scripts.[1]
Enterprise T1059 .001 命令与脚本解释器: PowerShell

SQLRat has used PowerShell to create a Meterpreter session.[1]
.003 命令与脚本解释器: Windows Command Shell

SQLRat has used SQL to execute JavaScript and VB scripts on the host system.[1]
Enterprise T1027 .010 混淆文件或信息: Command Obfuscation

SQLRat has used a character insertion obfuscation technique, making the script appear to contain Chinese characters.[1]
Enterprise T1204 .002 用户执行: Malicious File

SQLRat relies on users clicking on an embedded image to execute the scripts.[1]
Enterprise T1070 .004 移除指标: File Deletion

SQLRat has used been observed deleting scripts once used.[1]

Enterprise T1105 输入工具传输

SQLRat can make a direct SQL connection to a Microsoft database controlled by the attackers, retrieve an item from the bindata table, then write and execute the file on disk.[1]

Enterprise T1053 .005 预定任务/作业: Scheduled Task

SQLRat has created scheduled tasks in %appdata%\Roaming\Microsoft\Templates\.[1]

Groups That Use This Software

ID Name References
G0046 FIN7

[1]

References

  1. Platt, J. and Reeves, J.. (2019, March). FIN7 Revisited: Inside Astra Panel and SQLRat Malware. Retrieved June 18, 2019.