(Talos) The second implant hosted on MagicRAT's C2 is a remote access trojan (RAT) known as TigerRAT. TigerRAT is an implant disclosed in 2021 by KISA and KRCERT as part of 'Operation ByteTiger'' detailing TigerRAT and its downloader 'TigerDownloader.' This implant consists of several RAT capabilities, ranging from arbitrary command execution to file management.
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
| IP:Port | Timestamp |
|---|
| Domain | Timestamp |
|---|
| URL | Timestamp |
|---|
2023-11-10 by ASEC Analysis Team from AhnLab
2023-08-31 by Sanseo from AhnLab
2023-08-22 by ASEC Analysis Team from AhnLab
2023-02-09 by NSA from
2023-01-05 by Francis Guibernau from AttackIQ
2022-09-07 by Jung soo An from Cisco Talos
2021-12-22 by Markel Picado Ortiz from Threatray
2021-12-03 by VMWare from vmware
2021-11-10 by ASEC Analysis Team from AhnLab
2021-09-02 by KrCERT from KrCert
2021-07-15 by Mathieu Gaucheler from BrightTALK
2021-06-15 by Seongsu Park from Kaspersky
Tool: TigerRAT
Names: TigerRAT, Tiger RAT
Description: (Talos) The second implant hosted on MagicRAT's C2 is a remote access trojan (RAT) known as TigerRAT. TigerRAT is an implant disclosed in 2021 by KISA and KRCERT as part of 'Operation ByteTiger'' detailing TigerRAT and its downloader 'TigerDownloader.' This implant consists of several RAT capabilities, ranging from arbitrary command execution to file management.
Category: Malware
Type: Backdoor
Information: https://blog.talosintelligence.com/2022/09/lazarus-magicrat.html
Malpedia: https://malpedia.caad.fkie.fraunhofer.de/details/win.tiger_rat
Last-card-change: 2022-12-28
Source: https://apt.etda.or.th/cgi-bin/listtools.cgi
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
T1053.002 SCHEDULED TASK/JOB : AT at can be used to schedule a task on a system to be executed at a specific date or time. | T1053.002 SCHEDULED TASK/JOB : AT at can be used to schedule a task on a system to be executed at a specific date or time. | T1053.002 SCHEDULED TASK/JOB : AT at can be used to schedule a task on a system to be executed at a specific date or time. |