FormerFirstRAT
Description
(Palo Alto) This remote administration tool (RAT) is referred to as “FormerFirstRAT” by its authors. FormerFirstRAT communicates using unencrypted HTTP over port 443; the use of mismatching ports and communication protocols is not uncommon in targeted attack campaigns. In addition, port / protocol mis-match traffic can be an indicator of bad activity.
The remote server has the ability to respond and provide instructions to the RAT. We have identified the following functionalities: • Modify sleep timer between requests • Execute a command and return the command output • Browse the file system • Download files • Delete files • Exfiltrate victim information
Names
| Name |
|---|
| FormerFirstRAT |
| FF-RAT |
| ffrat |
Category
Malware
Type
- Backdoor
- Exfiltration
Information
Malpedia
Alienvault Otx
Other Information
Uuid
d04ba5af-cabc-4710-bf6e-84688a211480
Last Card Change
2020-04-23