Loading malware…
ProRat is a Windows remote access trojan from the early 2000s associated with the PRO Group. It is an established legacy RAT family that uses a client-server architecture in which a victim-side payload provides unauthorized remote access to an attacker-controlled controller application. ProRat belongs to the generation of commercialized and black-hat RAT tooling that expanded on earlier families by combining remote administration features with persistence and extensibility.
ProRat is designed to give an operator covert control over an infected system. Reported capabilities include remote system access, file browsing and transfer, screenshot-related functionality, and support for remote plugins that can be uploaded and executed on compromised hosts. Analysis of the malware has shown that its protocol uses command identifiers and separate ports for different functions, including file upload and plugin handling. Its communications have been observed in plaintext, making the protocol susceptible to interception and abuse. Reverse engineering has also shown that the payload was packed with UPX and that the malware can establish persistence on Windows through filesystem and registry modifications.
As a RAT family, ProRat fits the broader pattern of malware used for unauthorized surveillance and post-compromise control, including theft of credentials and other sensitive user data, monitoring of victim activity, and execution of additional payloads. Legacy RATs of this class were commonly distributed through social engineering and malicious downloads, including crafted email attachments, malicious links, bundled download packages, and torrent-distributed lures. ProRat is primarily associated with Windows systems and is historically notable as one of the better-known RAT families of the 2000s era.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
8 distinct techniques documented for this family, organized by ATT&CK tactic.
After deploying the payload, RegShot showed that many registry keys were modified or added: Several files were added for persistence: C:\WINDOWS\system\sservice.exe C:\WINDOWS\system32\fservice.exe C:\WINDOWS\system32\reginv.dll C:\WINDOWS\system32\winkey.dll C:\WINDOWS\services.exe
The principle of remote plugins is uploading the PE file ( .*exe or *.dll ) to the compromised machine and executing it, or loading it via LoadLibraryA .
Compare to the previous generation, this RAT tools include a builder and are usually packed with UPX. They also have more advanced features, such as DLL injection, API hooking, remote plugins, and persistence techniques.
After deploying the payload, RegShot showed that many registry keys were modified or added: Several files were added for persistence: C:\WINDOWS\system\sservice.exe C:\WINDOWS\system32\fservice.exe C:\WINDOWS\system32\reginv.dll C:\WINDOWS\system32\winkey.dll C:\WINDOWS\services.exe
ProRat transfers data in plain text without any protection. It uses different integer values to identify different C2 commands: Notice that ProRat assigns a different port number for its features: It uses different port for screenshot: Furthermore, it assigns different port for remote plugins and file uploading
Based on the MZ symbol observed in the packet, we can infer that the remote plugin mechanism of ProRat works as follows: It drops a specific executable into the local %TEMP% directory, uploads it to the compromised machine, and the payload executes the plugin file and returns the result to the controller.
Remote Access Trojans are programs that provide the capability to allow covert surveillance or the ability to gain unauthorized access to a victim PC... they provide the capability for an attacker to gain unauthorized remote access to the victim machine via specially configured communication protocols which are set up upon initial infection of the victim computer.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A 2000s-era RAT included in a generation of tools that commonly featured builders, UPX packing, DLL injection, API hooking, remote plugin execution, persistence techniques, and mutex functionality.
A legacy remote access tool that provides unauthorized remote control of victim machines. The article describes its client-server architecture, plaintext C2 communications, persistence via dropped files and registry changes, multiple ports for different features, and a remote plugin/file upload capability that can execute uploaded binaries on the compromised host.
An established remote access trojan family mentioned as part of known RAT programs.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.