ComRAT

Malware Profile Updated 25 days ago
Download STIX
Preview STIX
ComRAT, also known as Agent.BTZ, is a potent malware that has evolved over the years to become a significant threat in the cybersecurity landscape. Developed using C++ and employing a virtual FAT16 file system, ComRAT is often used to exfiltrate sensitive documents. The malware is a remote access trojan (RAT) utilized by the Turla group, a cyber espionage group. Over time, several variants of this malware have been identified, including a .NET injector variant from 2018 and multiple .NET injector variants from 2019, all associated with the ComRAT variant. The latest iteration of ComRAT, version 4, was active as of 2020. The ComRAT v4 malware was typically embedded within files such as 'profilec.py' by the same submitter, demonstrating its advanced techniques for infiltration and persistence. This malware variant is characterized by its use of sophisticated MITRE ATT&CK techniques in its attacks. Additionally, it has been associated with other complex implants used by Turla, such as Carbon and Gazer. In one notable instance, a PowerShell dropper was used to drop ComRAT to disk, an action detected by Cortex XDR in detect mode. Prevention and detection alerts were raised for each malware, including ComRAT, with its DLL execution and PowerShell dropper execution prevention alerts shown in Cortex XDR. This highlights the importance of robust cybersecurity measures in combating threats like ComRAT. Despite its evolution over a ten-year journey, the fight against ComRAT continues, underscoring the ongoing challenge of managing and mitigating advanced persistent threats in today's digital environment.
What's your take? (Question 1 of 5)
577955b1-6e35-4bbf-b24e-9fd3484ae407 Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
Agent.btz
3
Agent.btz, also known as ComRAT v4, is a remote access trojan (RAT) developed using C++ and employing a virtual FAT16 file system. This malicious software was one of the earliest backdoors used by Pensive Ursa, a cyber-espionage group. Notably, the malware is frequently used to exfiltrate sensitive
Snake
3
Snake, also known as Turla or EKANS, is a significant threat actor that has been active since at least 2004 and possibly as far back as the late 1990s. This cybercrime group possesses an extensive arsenal of tools and malware, including AgentTesla, FormBook, Remcos, LokiBot, GuLoader, Snake Keylogge
Comrat V4
3
ComRAT v4, also known as Agent.BTZ, is a sophisticated malware developed using C++ and employing a virtual FAT16 file system. This malicious software is a Remote Access Trojan (RAT) primarily used by the Turla group, a cyber-espionage entity. The primary function of ComRAT v4 is to exfiltrate sensit
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Malware
Backdoor
Implant
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
UroburosUnspecified
2
Uroburos, also known as Snake, Turla, Pensive Ursa, and Venomous Bear, is a sophisticated malware linked to the Russian Federal Security Service (FSB). The development of this malicious software began in late 2003, with its operations traced back to at least 2004. Uroburos is part of a broader arsen
MosquitoUnspecified
2
The "Mosquito" malware is a harmful software designed to exploit and damage computer systems or devices. It operates covertly, infiltrating systems through suspicious downloads, emails, or websites, often unbeknownst to the user. Once inside, it has the capability to steal personal information, disr
ChinchUnspecified
2
None
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
TurlaUnspecified
5
Turla, also known as Pensive Ursa, Snake, Uroburos, Waterbug, Venomous Bear, and KRYPTON, is a threat actor that has been active since at least 2004. This group, which is believed to be Russia-sponsored, primarily targets diplomatic and government organizations, private businesses, and non-governmen
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Source Document References
Information about the ComRAT Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
SourceCreatedAtTitle
MITRE
a year ago
IronNetInjector: Turla’s New Malware Loading Tool
Unit42
8 months ago
Threat Group Assessment: Turla (aka Pensive Ursa)
CERT-EU
a year ago
Kaspersky Analyzes Links Between Russian State-Sponsored APTs
CISA
a year ago
Hunting Russian Intelligence “Snake” Malware | CISA
MITRE
a year ago
Shedding Skin - Turla’s Fresh Faces | Securelist
MITRE
a year ago
A dive into Turla PowerShell usage | WeLiveSecurity
CERT-EU
a year ago
Hunting Russian Intelligence “Snake” Malware - KizzMyAnthia.com
CERT-EU
a year ago
Matthieu Faou | WeLiveSecurity
Trend Micro
8 months ago
Examining the Activities of the Turla APT Group
DARKReading
7 months ago
Upgraded Kazuar Backdoor Offers Stealthy Power
CERT-EU
9 months ago
Russia’s 'Turla' Group – A Formidable Cyberespionage Adversary
BankInfoSecurity
10 months ago
Russian Hackers Probe Ukrainian Defense Sector With Backdoor