SOFTWARE
SOFTWARE
A-B
C-D
E-F
G-H
I-J
K-L
M-N
O-P
Q-R
S-T
U-V
W-X
Cobian RAT
Cobian RAT is a backdoor, remote access tool that has been observed since 2016.[1]
ID: S0338
Type: MALWARE
Platforms: Windows
Version: 1.1
Created: 29 January 2019
Last Modified: 30 March 2020
Techniques Used
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1071 | .004 | Application Layer Protocol: DNS |
Cobian RAT uses DNS for C2.[1] |
Enterprise | T1123 | Audio Capture |
Cobian RAT has a feature to perform voice recording on the victim’s machine.[1] |
|
Enterprise | T1547 | .001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
Cobian RAT creates an autostart Registry key to ensure persistence.[1] |
Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell |
Cobian RAT can launch a remote command shell interface for executing commands.[1] |
Enterprise | T1132 | .001 | Data Encoding: Standard Encoding |
Cobian RAT obfuscates communications with the C2 server using Base64 encoding.[1] |
Enterprise | T1056 | .001 | Input Capture: Keylogging |
Cobian RAT has a feature to perform keylogging on the victim’s machine.[1] |
Enterprise | T1113 | Screen Capture |
Cobian RAT has a feature to perform screen capture.[1] |
|
Enterprise | T1125 | Video Capture |
Cobian RAT has a feature to access the webcam on the victim’s machine.[1] |
References
×