GodRAT Malware

MITRE Techniques

• [T1204] User Execution – Malicious .scr and .pif files masqueraded as financial documents and were distributed via Skype to trick users into running them. [‘malicious .scr and .pif files masquerading as financial documents’]
• [T1071] Application Layer Protocol – The implant connects to a Command-and-Control server, transmitting “GETGOD” and downloading a second-stage shellcode and DLL. [‘transmitting “GETGOD” to download a second-stage shellcode containing a UPX-packed GodRAT DLL’]
• [T1055] Process Injection – The UPX-packed GodRAT DLL executes via exported “run” and can inject into processes like curl.exe, cmd.exe, or svchost.exe using parameters such as “-Puppet”. [‘execute via the exported “run” function… inject itself into processes like curl.exe or cmd.exe using the “-Puppet” parameter’]
• [T1005] Data from Local System – The RAT collects OS details, hostname, process information, and antivirus presence, then compresses and encodes this data for exfiltration. [‘collecting victim data, such as OS details, hostname, process information, and antivirus presence, which is zlib-compressed, XOR-encoded, and sent to the C2 server’]
• [T1113] Screen Capture / [T1115] Clipboard Data – (FileManager activity enabling file operations and hidden 7zip usage indicates extensive local data collection capabilities, including file reads and execution.) [‘FileManager plugin… enabling attackers to list files, read/write data, delete files, create directories, and execute commands via a hidden 7zip utility’]
• [T1566] Phishing – Distribution via Skype messenger leveraged trust in the communication platform to deliver malicious attachments to targets. [‘distributed via Skype messenger, exploiting the platform’s trust to deliver payloads’]
• [T1027] Obfuscated Files or Information – Steganography was used to hide shellcode in image files and XOR/zlib encoding was used for configuration and exfiltrated data. [‘steganography to conceal shellcode within image files’ ; ‘XOR-decodes embedded shellcode’ ; ‘zlib-compressed, XOR-encoded’]
• [T1543] Create or Modify System Process – The builder supports injection into legitimate processes for persistence and stealth. [‘builder allows customization of payloads, supporting executable injection into legitimate processes like svchost.exe or curl.exe’]