RomeoWhiskey
Description
(Novetta) In terms of sophistication and functionality, RomeoWhiskey is a mid-tier RAT. At its core, RomeoWhiskey provides the basic functionality one would expect in a RAT: file transfer commands, program execution, basic intelligence gathering, etcetera. Observed as early as May 2011, RomeoWhiskey, also known as Winsec, is one of the older family members used by the Lazarus Group, and, over the course of its lifetime, it has undergone at least one major revision. The first variant of RomeoWhiskey, RomeoWhiskey–One, has been observed with compile dates from May 2011 to late January/early February 2012, while RomeoWhiskey-Two, the second variant, was compiled from late February 2012 until at least March 2014.
RomeoWhiskey uses numerical constants to identify specific commands, reflective of the way RATs like the Romeo-CoreOne-based families (see Section 2) identify commands by unique numerical constants. There are two sets of constants for identifying commands within the RomeoWhiskey samples that do not necessarily align with variant boundaries: command base 0x7D50 and command base 0x1E10.
Names
| Name |
|---|
| RomeoWhiskey |
| Winsec |
Category
Malware
Type
- Backdoor
- Info stealer
- Exfiltration
Information
Other Information
Uuid
cef31157-132a-4436-8a09-076be4a1747d
Last Card Change
2020-04-20