T-RAT Malware Threat Intel Advisory

Published on October 29, 2020 | 20:30 IST

Share this Advisory:

Malware 
Trojan
Command & Control
Telegram
Target Platform
Windows

 

T-RAT is a Windows remote access trojan (RAT) that uses Telegram as a Command & Control (C2) channel to monitor the victims and steal their private data. The author of the malware highlights the integration capabilities of T-RAT as a selling point. This feature allows the malware to control the infected hosts and makes it easy to use.  

Users of T-RAT can enter their commands by typing them in the chat window of the VoiP, instant messaging app Telegram. More than ninety commands are available at the user’s disposal and they are capable of performing the following functions:

  • File system navigation
  • Keylogging
  • Audio recording
  • Screen capture
  • Webcam monitoring
  • Clipboard access

This malware is also capable of interacting with Windows operating system via PowerShell and CMD, to manipulate running processes especially those which are security related. A second Command & Control channel is provided in the RAT via RDP/ VNC.

T-RAT is also capable of hijacking crypto transactions leveraging the clipboard access feature, to target payment solutions like:

  • Qiwi
  • WMR
  • WMZ
  • WME
  • WMX
  • Yandex Money
  • Payeer
  • CC
  • BTC
  • BTCG
  • Ripple
  • Dogecoin
  • Tron

T-RAT is being sold on various Russian speaking underground forums, with graphics illustrations of its features, the major selling point being Telegram integrations, used for C2 communications, making it easy to deploy the malware. 

T-RAT Malware Threat Intel Advisory

Impact

Tech
  • Private data and credentials are compromised.
  • Full [unauthorized] access to file systems and services. 
  • Privacy violation due to compromise of peripheral devices like webcam and microphone.
  • Adding the victims to the botnet to further the attack (DDoS) against potential targets.
  • Enables attackers to make digital fingerprints of their victims.
Business
  • Corporate endpoints are exploited to gain access to internal networks.
  • VPN access can be compromised via keylogging.

Mitigations

  • Use EDR solutions to prevent such attacks.
  • Cyber hygiene and user awareness are critical to enhance security.
  • Beware of emails that come with suspicious attachments (Office doc/ PDF).

Be informed in your Inbox

Sign up now to our Threat intelligence Newsletter and be the first to know about threats first in your inbox.

Join the Discussions

Discuss your way into our Community about these threats and stay Vigilant and informed.