PoetRAT

PoetRAT is a remote access trojan (RAT) that was first identified in April 2020. PoetRAT has been used in multiple campaigns against the private and public sectors in Azerbaijan, including ICS and SCADA systems in the energy sector. The STIBNITE activity group has been observed using the malware. PoetRAT derived its name from references in the code to poet William Shakespeare. ^[1][2][3]

ID: S0428

ⓘ

Type: MALWARE

ⓘ

Platforms: Windows

Version: 2.3

Created: 27 April 2020

Last Modified: 05 August 2024

Version Permalink

Live Version

ATT&CK^® Navigator Layers

Enterprise Layer

download view

Techniques Used

PoetRAT has used HTTP and HTTPs for C2 communications.^[2]

PoetRAT has used FTP for C2 communications.^[2]

PoetRAT has the ability to compress files with zip.^[1]

PoetRAT used file system monitoring to track modification and enable automatic exfiltration.^[1]

PoetRAT has called cmd through a Word document macro.^[2]

PoetRAT has used Word documents with VBScripts to execute malicious activities.^[1][2]

PoetRAT was executed with a Python script and worked in conjunction with additional Python-based post-exploitation tools.^[1]

PoetRAT has executed a Lua script through a Lua interpreter for Windows.^[2]

PoetRAT has used a Python tool named Browdec.exe to steal browser credentials.^[1]

PoetRAT has used LZMA and base64 libraries to decode obfuscated scripts.^[2]

PoetRAT used TLS to encrypt command and control (C2) communications.^[1]

PoetRAT has used a .NET tool named dog.exe to exiltrate information over an e-mail account.^[1]

PoetRAT has used ftp for exfiltration.^[1]

PoetRAT has exfiltrated data over the C2 channel.^[2]

PoetRAT has the ability to list files upon receiving the ls command from C2.^[1]

PoetRAT has the ability to hide and unhide files.^[1]

PoetRAT has the ability to overwrite scripts and delete itself if a sandbox environment is detected.^[1]

PoetRAT has the ability to copy files and download/upload files into C2 channels using FTP and HTTPS.^[1][2]

PoetRAT has used a Python tool named klog.exe for keylogging.^[1]

PoetRAT was delivered with documents using DDE to execute malicious code.^[1]

PoetRAT has made registry modifications to alter its behavior upon execution.^[1]

PoetRAT used TLS to encrypt communications over port 143^[1]

PoetRAT has used a custom encryption scheme for communication between scripts.^[1]

PoetRAT has pyminifier to obfuscate scripts.^[2]

PoetRAT used voStro.exe, a compiled pypykatz (Python version of Mimikatz), to steal credentials.^[1]

PoetRAT was distributed via malicious Word documents.^[1]

PoetRAT has the ability to list all running processes.^[1]

PoetRAT used Nmap for remote system discovery.^[1]

PoetRAT has the ability to take screen captures.^[1][3]

PoetRAT has the ability to gather information about the compromised host.^[1]

PoetRAT sent username, computer name, and the previously generated UUID in reply to a "who" command from C2.^[1]

PoetRAT has used spearphishing attachments to infect victims.^[1]

PoetRAT has used a Python tool named Bewmac to record the webcam on compromised hosts.^[1]

PoetRAT checked the size of the hard drive to determine if it was being run in a sandbox environment. In the event of sandbox detection, it would delete itself by overwriting the malware scripts with the contents of "License.txt" and exiting.^[1]

References