Deed RAT
Description
(BleepingComputer) Deed RAT’s functions depend on which plugins are fetched and loaded. For example, PT has seen eight plugins for startup, C2 config, installation, code injection into processes, network interactions, connection management, registry editing, registry monitoring, and proxy sniffing.
The supported protocols for C2 communication include TCP, TLS, HTTP, HTTPS, UDP, and DNS, so there’s generally a high level of versatility.
The commands supported by Deed RAT are the following: • Collect system information • Create a separate communication channel for a plugin • Self-remove • Ping • Deactivate connection • Update the shellcode for an injection stored in the registry • Update the main shellcode on disk and delete all plugins
Names
| Name |
|---|
| Deed RAT |
| SnappyBee |
Category
Malware
Type
- Reconnaissance
- Backdoor
- Loader
Information
- https://www.bleepingcomputer.com/news/security/chinese-space-pirates-are-hacking-russian-aerospace-firms/
- https://www.ptsecurity.com/ru-ru/research/pt-esc-threat-intelligence/space-pirates-tools-and-connections/
Other Information
Uuid
53fff35a-7a4a-466a-8baa-02ffb46929ec
Last Card Change
2024-12-26