T-RAT Malware Threat Intel Advisory

CloudSEK Threat Intelligence Advisory on T-RAT, uses Telegram as its Command & Control channel, capable of keylogging, screen capture, etc.
Updated on
February 27, 2023
Published on
October 29, 2020
Read time
5
Subscribe to the latest industry news, technologies and resources.
Malware 
Trojan
Command & Control
Telegram
Target Platform
Windows
  T-RAT is a Windows remote access trojan (RAT) that uses Telegram as a Command & Control (C2) channel to monitor the victims and steal their private data. The author of the malware highlights the integration capabilities of T-RAT as a selling point. This feature allows the malware to control the infected hosts and makes it easy to use.   Users of T-RAT can enter their commands by typing them in the chat window of the VoiP, instant messaging app Telegram. More than ninety commands are available at the user’s disposal and they are capable of performing the following functions:
  • File system navigation
  • Keylogging
  • Audio recording
  • Screen capture
  • Webcam monitoring
  • Clipboard access
This malware is also capable of interacting with Windows operating system via PowerShell and CMD, to manipulate running processes especially those which are security related. A second Command & Control channel is provided in the RAT via RDP/ VNC. T-RAT is also capable of hijacking crypto transactions leveraging the clipboard access feature, to target payment solutions like:
  • Qiwi
  • WMR
  • WMZ
  • WME
  • WMX
  • Yandex Money
  • Payeer
  • CC
  • BTC
  • BTCG
  • Ripple
  • Dogecoin
  • Tron
T-RAT is being sold on various Russian speaking underground forums, with graphics illustrations of its features, the major selling point being Telegram integrations, used for C2 communications, making it easy to deploy the malware.  T-RAT Malware Threat Intel Advisory[/vc_wp_text][vc_wp_text]

Impact

Tech
  • Private data and credentials are compromised.
  • Full [unauthorized] access to file systems and services. 
  • Privacy violation due to compromise of peripheral devices like webcam and microphone.
  • Adding the victims to the botnet to further the attack (DDoS) against potential targets.
  • Enables attackers to make digital fingerprints of their victims.
Business
  • Corporate endpoints are exploited to gain access to internal networks.
  • VPN access can be compromised via keylogging.
[/vc_wp_text][vc_wp_text]

Mitigations

  • Use EDR solutions to prevent such attacks.
  • Cyber hygiene and user awareness are critical to enhance security.
  • Beware of emails that come with suspicious attachments (Office doc/ PDF).

Get Global Threat Intelligence on Real Time

Protect your business from cyber threats with real-time global threat intelligence data.. 30-day free and No Commitment Trial.
Schedule a Demo
Real time Threat Intelligence Data
More information and context about Underground Chatter
On-Demand Research Services
Related Intelligence Posts
No items found.