(Novetta) In terms of sophistication and functionality, RomeoWhiskey is a mid-tier RAT. At its core, RomeoWhiskey provides the basic functionality one would expect in a RAT: file transfer commands, program execution, basic intelligence gathering, etcetera. Observed as early as May 2011, RomeoWhiskey, also known as Winsec, is one of the older family members used by the Lazarus Group, and, over the course of its lifetime, it has undergone at least one major revision. The first variant of RomeoWhiskey, RomeoWhiskey–One, has been observed with compile dates from May 2011 to late January/early February 2012, while RomeoWhiskey-Two, the second variant, was compiled from late February 2012 until at least March 2014. RomeoWhiskey uses numerical constants to identify specific commands, reflective of the way RATs like the Romeo-CoreOne-based families (see Section 2) identify commands by unique numerical constants. There are two sets of constants for identifying commands within the RomeoWhiskey samples that do not necessarily align with variant boundaries: command base 0x7D50 and command base 0x1E10.
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
| IP:Port | Timestamp |
|---|
| Domain | Timestamp |
|---|
| URL | Timestamp |
|---|
Tool: RomeoWhiskey
Names: RomeoWhiskey, Winsec
Description: (Novetta) In terms of sophistication and functionality, RomeoWhiskey is a mid-tier RAT. At its core, RomeoWhiskey provides the basic functionality one would expect in a RAT: file transfer commands, program execution, basic intelligence gathering, etcetera. Observed as early as May 2011, RomeoWhiskey, also known as Winsec, is one of the older family members used by the Lazarus Group, and, over the course of its lifetime, it has undergone at least one major revision. The first variant of RomeoWhiskey, RomeoWhiskey–One, has been observed with compile dates from May 2011 to late January/early February 2012, while RomeoWhiskey-Two, the second variant, was compiled from late February 2012 until at least March 2014. RomeoWhiskey uses numerical constants to identify specific commands, reflective of the way RATs like the Romeo-CoreOne-based families (see Section 2) identify commands by unique numerical constants. There are two sets of constants for identifying commands within the RomeoWhiskey samples that do not necessarily align with variant boundaries: command base 0x7D50 and command base 0x1E10.
Category: Malware
Type: Backdoor, Info stealer, Exfiltration
Information: https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf
Last-card-change: 2020-04-20
Source: https://apt.etda.or.th/cgi-bin/listtools.cgi
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |