P8RAT
ID: S0626
ⓘ
Associated Software: HEAVYPOT, GreetCake
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.0
Created: 21 June 2021
Last Modified: 14 October 2021
Associated Software Descriptions
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1001 | .001 | 数据混淆: Junk Data |
P8RAT can send randomly-generated data as part of its C2 communication.[1] |
| Enterprise | T1497 | .001 | 虚拟化/沙盒规避: System Checks |
P8RAT can check the compromised host for processes associated with VMware or VirtualBox environments.[1] |
| .003 | 虚拟化/沙盒规避: Time Based Evasion |
P8RAT has the ability to "sleep" for a specified time to evade detection.[1] |
||
| Enterprise | T1105 | 输入工具传输 |
P8RAT can download additional payloads to a target system.[1] |
|
| Enterprise | T1057 | 进程发现 |
P8RAT can check for specific processes associated with virtual environments.[1] |
|