CrossRAT

CrossRAT is a cross platform RAT.

ID: S0235

ⓘ

Type: MALWARE

ⓘ

Platforms: Linux, Windows, macOS

Version: 1.2

Created: 17 October 2018

Last Modified: 28 September 2023

Techniques Used

Domain	ID		Name	Use
Enterprise	T1543	.001	创建或修改系统进程: Launch Agent	CrossRAT creates a Launch Agent on macOS.^[1]
Enterprise	T1547	.001	启动或登录自动启动执行: Registry Run Keys / Startup Folder	CrossRAT uses run keys for persistence on Windows.^[1]
		.013	启动或登录自动启动执行: XDG Autostart Entries	CrossRAT can use an XDG Autostart to establish persistence.^[2]
Enterprise	T1113		屏幕捕获	CrossRAT is capable of taking screen captures.^[1]
Enterprise	T1083		文件和目录发现	CrossRAT can list all files on a system.^[1]

ID	Name	References
G0070	Dark Caracal	^[1]