All Threat Intelligence posts

T-RAT Malware Threat Intel Advisory

October 30, 2020
•
4
min read
Malware 
 Trojan
Command & Control
 Telegram
Target Platform
 Windows

 

T-RAT is a Windows remote access trojan (RAT) that uses Telegram as a Command & Control (C2) channel to monitor the victims and steal their private data. The author of the malware highlights the integration capabilities of T-RAT as a selling point. This feature allows the malware to control the infected hosts and makes it easy to use.  

Users of T-RAT can enter their commands by typing them in the chat window of the VoiP, instant messaging app Telegram. More than ninety commands are available at the user’s disposal and they are capable of performing the following functions:

  • File system navigation
  • Keylogging
  • Audio recording
  • Screen capture
  • Webcam monitoring
  • Clipboard access

This malware is also capable of interacting with Windows operating system via PowerShell and CMD, to manipulate running processes especially those which are security related. A second Command & Control channel is provided in the RAT via RDP/ VNC.

T-RAT is also capable of hijacking crypto transactions leveraging the clipboard access feature, to target payment solutions like:

  • Qiwi
  • WMR
  • WMZ
  • WME
  • WMX
  • Yandex Money
  • Payeer
  • CC
  • BTC
  • BTCG
  • Ripple
  • Dogecoin
  • Tron

T-RAT is being sold on various Russian speaking underground forums, with graphics illustrations of its features, the major selling point being Telegram integrations, used for C2 communications, making it easy to deploy the malware. 

T-RAT Malware Threat Intel Advisory[/vc_wp_text][vc_wp_text]

Impact

Tech
  • Private data and credentials are compromised.
  • Full access to file systems and services. 
  • Privacy violation due to compromise of peripheral devices like webcam and microphone.
  • Adding the victims to the botnet to further the attack (DDoS) against potential targets.
  • Enables attackers to make digital fingerprints of their victims.
Business
  • Corporate endpoints are exploited to gain access to internal networks.
  • VPN access can be compromised via keylogging.

[/vc_wp_text][vc_wp_text]

Mitigations

  • Use EDR solutions to prevent such attacks.
  • Cyber hygiene and user awareness are critical to enhance security.
  • Beware of emails that come with suspicious attachments (Office doc/ PDF).
Tags:
‍
No items found.