Earlyrat

Malware updated 7 months ago (2024-05-04T17:40:22.238Z)

Download STIX

Preview STIX

EarlyRat is a previously undocumented malware discovered by Kaspersky researchers in June. The North Korea-linked Advanced Persistent Threat (APT) group Andariel used EarlyRat in attacks exploiting the Log4j Log4Shell vulnerability last year. The malware was first noticed in one of the Log4j cases, and it was assumed that it was downloaded via Log4j. EarlyRat, like the phishing document, is very simple: it is capable of executing commands, but nothing else of interest. The malware has been associated with the North Korea-backed Lazarus Group, specifically a branch thereof. More recently, the group was detected earlier this year using another new malware family called EarlyRat in conjunction with DTrack malware and Maui ransomware. These malicious programs were used to exploit the Log4j flaw for initial access. When hunting for more samples, researchers found phishing documents that ultimately dropped EarlyRat. Researchers have identified high-level similarities between EarlyRat and another malware known as MagicRat. Both are written using different frameworks: QT is used for MagicRat and PureBasic for EarlyRat. Furthermore, CollectionRAT appears related to the "EarlyRat" family, indicating potential shared origins or development strategies. Despite its simplicity, EarlyRat's association with significant cyber threats underscores its potential danger.

Description last updated: 2024-05-04T16:47:31.130Z

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.

Alias Description	Votes
Magicrat is a possible alias for Earlyrat. MagicRAT is a type of malware, first observed by Cisco Talos in 2022, that was used by the Lazarus Group to exploit vulnerabilities in publicly exposed VMWare Horizon platforms, primarily targeting energy companies worldwide. This malicious software, which can infiltrate systems through suspicious d	2

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Phishing

Log4j

Malware

Vulnerability

Apt

Analyst Notes & Discussion

Be the first to leave your mark here! Log in to share your views and vote.

Associated Malware

To see the evidence that has resulted in these malware associations, create a free account

Alias Description	Association Type	Votes
The Collectionrat Malware is associated with Earlyrat. CollectionRAT is a malicious software (malware) first identified in a Cisco Talos report in 2023, with samples dating as far back as 2021. This Windows-based Remote Access Trojan (RAT) is believed to be connected to the Jupiter/EarlyRAT malware family, which has previously been linked to a Lazarus s	Unspecified	2
The Quiterat Malware is associated with Earlyrat. QuiteRAT is a new type of malware associated with the North Korea-linked Lazarus Group, known for their use of custom malware. Built using the Qt framework, QuiteRAT is smaller in size compared to MagicRAT, another malware linked to the group, due to its incorporation of fewer Qt libraries and lack	Unspecified	2

Associated Threat Actors

To see the evidence that has resulted in these threatActor associations, create a free account

Alias Description	Association Type	Votes
The Lazarus Group Threat Actor is associated with Earlyrat. The Lazarus Group, a notorious North Korean state-sponsored threat actor, is among the most prolific and dangerous cyber threat actors in operation. The group has been involved in several high-profile cyber-attacks, including Operation DreamJob in Spain, with the primary objective of funding North K	Unspecified	3
The Andariel Threat Actor is associated with Earlyrat. Andariel, a threat actor controlled by North Korea's military intelligence agency, the Reconnaissance General Bureau, has been actively conducting cyber espionage and ransomware operations. The group funds its activities through ransomware attacks primarily targeting U.S. healthcare entities. In som	Unspecified	2

Associated Vulnerabilities

To see the evidence that has resulted in these vulnerability associations, create a free account

Alias Description	Association Type	Votes
The Log4Shell Vulnerability is associated with Earlyrat. Log4Shell is a significant software vulnerability (CVE-2021-44228, CVE-2021-45046, and CVE-2021-45105) that exists in the Log4j Java-based logging utility. It was exploited by various Advanced Persistent Threat (APT) actors, including LockBit affiliates and GOLD MELODY (UNC961), to gain unauthorized	Unspecified	2

Source Document References

Information about the Earlyrat Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source Link	CreatedAt	Title
CERT-EU	a year ago	Lazarus Group Exploits Log4j Flaw in New Malware Campaign
Securityaffairs	a year ago	Operation Blacksmith: Lazarus exploits Log4j flaws to deploy DLang malware
CERT-EU	a year ago	IT threat evolution in Q2 2023 – GIXtools
CERT-EU	a year ago	IT threat evolution Q2 2023
CERT-EU	a year ago	Lazarus Group Exploits Critical Zoho ManageEngine Flaw to Deploy Stealthy QuiteRAT Malware
CERT-EU	a year ago	Hackers use public ManageEngine exploit to breach internet org
CERT-EU	a year ago	Attacks by Lazarus sub-group involve novel EarlyRAT malware
CERT-EU	a year ago	New Malware Alert: EarlyRAT Linked to North Korean Hacking Group
CERT-EU	a year ago	Log4j bug exploited to push novel EarlyRat malware
CERT-EU	a year ago	North Korean Hacker Group Andariel Strikes with New EarlyRat Malware
CERT-EU	a year ago	North Korea-linked Andariel APT used a new malware named EarlyRat last year \| IT Security News
Securityaffairs	a year ago	North Korean Andariel APT used a new malware named EarlyRat
BankInfoSecurity	a year ago	New Malware by Lazarus-Backed Andariel Group Exploits Log4j
CERT-EU	a year ago	North Korean Hacker Group Andariel Strikes with New EarlyRat Malware – GIXtools
CERT-EU	a year ago	Andariel’s Mistakes Uncover New Malware in Lazarus Group Campaign
CERT-EU	a year ago	Andariel’s silly mistakes and a new malware family – GIXtools
CERT-EU	a year ago	Kaspersky crimeware report: Andariel’s mistakes and EasyRat malware