Earlyrat

Malware Profile Updated 25 days ago
Download STIX
Preview STIX
EarlyRat is a previously undocumented malware discovered by Kaspersky researchers in June. The North Korea-linked Advanced Persistent Threat (APT) group Andariel used EarlyRat in attacks exploiting the Log4j Log4Shell vulnerability last year. The malware was first noticed in one of the Log4j cases, and it was assumed that it was downloaded via Log4j. EarlyRat, like the phishing document, is very simple: it is capable of executing commands, but nothing else of interest. The malware has been associated with the North Korea-backed Lazarus Group, specifically a branch thereof. More recently, the group was detected earlier this year using another new malware family called EarlyRat in conjunction with DTrack malware and Maui ransomware. These malicious programs were used to exploit the Log4j flaw for initial access. When hunting for more samples, researchers found phishing documents that ultimately dropped EarlyRat. Researchers have identified high-level similarities between EarlyRat and another malware known as MagicRat. Both are written using different frameworks: QT is used for MagicRat and PureBasic for EarlyRat. Furthermore, CollectionRAT appears related to the "EarlyRat" family, indicating potential shared origins or development strategies. Despite its simplicity, EarlyRat's association with significant cyber threats underscores its potential danger.
What's your take? (Question 1 of 5)
f5017a22-2614-426e-9dc7-f509ab48d860 Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
Magicrat
2
MagicRAT is a type of malware, first observed by Cisco Talos in 2022, that was used by the Lazarus Group to exploit vulnerabilities in publicly exposed VMWare Horizon platforms, primarily targeting energy companies worldwide. This malicious software, which can infiltrate systems through suspicious d
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Phishing
Log4j
Malware
Vulnerability
Apt
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
CollectionratUnspecified
2
CollectionRAT is a newly identified malware, discovered by cybersecurity researchers who traced its origins through reused infrastructure components. This malicious software, short for Malware, is designed to exploit and damage computers or devices, often infiltrating systems via suspicious download
QuiteratUnspecified
2
QuiteRAT is a new type of malware associated with the North Korea-linked Lazarus Group, known for their use of custom malware. Built using the Qt framework, QuiteRAT is smaller in size compared to MagicRAT, another malware linked to the group, due to its incorporation of fewer Qt libraries and lack
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
Lazarus GroupUnspecified
3
The Lazarus Group, also known as Diamond Sleet, is a notorious threat actor attributed to numerous cyber-attacks and illicit activities. This group is associated with North Korea and has been implicated in several high-profile incidents, including Operation DreamJob in Spain, which was attributed to
AndarielUnspecified
2
Andariel, a threat actor and part of the Lazarus group, is known for its malicious activities in the cybersecurity domain. The group has been identified as being behind several cyberattacks, including those involving the use of DTrack malware and Maui ransomware which were observed in mid-2022. Anda
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
Log4ShellUnspecified
2
Log4Shell is a software vulnerability (CVE-2021-44228) discovered in 2021, which exists in the Apache Software Foundation's widely used Log4j logging software. This flaw in the software design or implementation poses significant supply chain risks as it can be present in various types of software, b
Source Document References
Information about the Earlyrat Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
SourceCreatedAtTitle
CERT-EU
a year ago
Log4j bug exploited to push novel EarlyRat malware
CERT-EU
a year ago
New Malware Alert: EarlyRAT Linked to North Korean Hacking Group
CERT-EU
a year ago
Kaspersky crimeware report: Andariel’s mistakes and EasyRat malware
CERT-EU
a year ago
Andariel’s silly mistakes and a new malware family – GIXtools
BankInfoSecurity
a year ago
New Malware by Lazarus-Backed Andariel Group Exploits Log4j
Securityaffairs
a year ago
North Korean Andariel APT used a new malware named EarlyRat
CERT-EU
a year ago
Attacks by Lazarus sub-group involve novel EarlyRAT malware
CERT-EU
a year ago
North Korea-linked Andariel APT used a new malware named EarlyRat last year | IT Security News
CERT-EU
9 months ago
IT threat evolution Q2 2023
CERT-EU
9 months ago
Hackers use public ManageEngine exploit to breach internet org
CERT-EU
a year ago
Andariel’s Mistakes Uncover New Malware in Lazarus Group Campaign
Securityaffairs
6 months ago
Operation Blacksmith: Lazarus exploits Log4j flaws to deploy DLang malware
CERT-EU
9 months ago
IT threat evolution in Q2 2023 – GIXtools
CERT-EU
a year ago
North Korean Hacker Group Andariel Strikes with New EarlyRat Malware
CERT-EU
9 months ago
Lazarus Group Exploits Critical Zoho ManageEngine Flaw to Deploy Stealthy QuiteRAT Malware
CERT-EU
a year ago
North Korean Hacker Group Andariel Strikes with New EarlyRat Malware – GIXtools
CERT-EU
6 months ago
Lazarus Group Exploits Log4j Flaw in New Malware Campaign