Loading malware…
CRAT is a modular Windows remote access trojan first observed in 2020 and used in targeted intrusions against South Korean users and organizations. It has been associated in multiple investigations with Lazarus-linked or broader North Korea-aligned tradecraft, and later reporting connected historical CRAT activity with the Larva-26005 cluster and overlap with Xctdoor and Hansom ransomware operations.
CRAT functions as a standalone RAT and also supports downloading and activating additional plugins from command-and-control infrastructure. Documented capabilities include system reconnaissance, collection of host and security-product information, file and directory enumeration, file read/write and movement operations, command execution, reverse shell access, and data exfiltration. Observed plugin functionality includes screen capture, clipboard monitoring, keylogging, and deployment of the Hansom ransomware component. In some cases, CRAT operators also used credential-stealing tooling to extract browser-stored credentials.
The malware uses multiple defense-evasion and anti-analysis measures, including string obfuscation, dynamic API resolution, runtime code patching, anti-debugging checks, and anti-infection logic based on host artifacts and analysis-tool blocklists. It commonly injects or reflectively loads itself into legitimate Windows processes and can activate DLL plugins through native Windows utilities or in-memory loading. Persistence has been established through scheduled tasks, services, shortcut files, and autorun mechanisms, often via dedicated EXE or DLL loaders that ultimately load the CRAT payload.
Observed delivery has included spear-phishing with malicious Hangul Word Processor documents exploiting CVE-2017-8291, as well as trojanized software distributed through South Korean community sites. Lures have included Korean-language themes such as public-health and business-related subjects. Reporting on later activity indicates operational continuity between CRAT-era campaigns and subsequent Xctdoor intrusions, including shared obfuscation patterns, similar installation conventions, and overlap with Hansom ransomware deployment. CRAT is therefore best understood as a modular RAT platform used in targeted espionage and financially motivated operations against Korean-speaking victims.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Cisco Talos has observed a new version of a remote access trojan (RAT) family known as CRAT. Apart from the prebuilt RAT capabilities, the malware can download and deploy additional malicious plugins on the infected endpoint.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Cisco Talos has observed a new version of a remote access trojan (RAT) family known as CRAT. Apart from the prebuilt RAT capabilities, the malware can download and deploy additional malicious plugins on the infected endpoint.
"Analysis of the Connection Between Xctdoor and Past CRAT Attack Cases (Larva-26005)" published by Ahnlab. #CVE20178291, #Phishing, #LNK, #Xctdoor, #CRAT, #Larva26005, #Hansom
39 distinct techniques documented for this family, organized by ATT&CK tactic.
Establish persistence for itself using a scheduled task on the infected endpoint. Usually scheduled to run once every few minutes.
Execute commands with two variations of the functionality: Simply execute the command on the endpoint. Execute a command and send output of command to C2.
Shellcode executing PowerShell to download and activate CRATv1 via regsvr32.
Enumerate drives using the 'dir' command: cmd /c "dir <drive_name> /s >> %temp%\<custom_prefix>error.log"
This variant will create a VBS file to run rar.exe to extract CRAT components.
Establish persistence for itself using a scheduled task on the infected endpoint. Usually scheduled to run once every few minutes.
Depending on the MS Windows OS version, it will inject and reflectively-load itself into the right process.
The RAT consists of multiple obfuscation techniques to hide strings, API names, command and control (C2) URLs and instrumental functions, along with static detection evasion.
Runtime Code Patching: The malware consists of a select few instrumental subroutines that are decoded, executed and then patched/encoded again (during runtime).
API Resolution: All APIs used are resolved dynamically. The process of selecting the API to call is also a cumbersome algorithm... involving index tables, switch cases and API name deobfuscation.
The attackers have also used file names and export API names in the CRAT DLLs to masquerade the RAT as a benign application's library.
Depending on the MS Windows OS version, it will inject and reflectively-load itself into the right process.
This command also deletes the target file once it has been added to the archive.
The implant will also timestomp the tmp file to either a hardcoded value or copy the filetimes from a system file such as %windir%\system32\user32.dll.
The implant performs checks to verify its execution on an allowed endpoint. The implant uses a variety of criteria to identify a blocklisted system by utilizing: Process name blocklists Network adapter name blocklists MAC Address blocklists Analysis tool names blocklists
TCP/IP enabled MAC Addresses using WMI query: wmic PATH Win32_NetworkAdapterConfiguration WHERE IPEnabled=TRUE GET MACAddress.
Collects the following system information: Installed AntiVirus software names Installed FirewallProduct names Domain Names... Path to the system folder Flag if the current user has administrative privileges
Collects size information about all files and folders on the infected endpoint... Enumerate drives using the 'dir' command | CRAT has the capability to read the contents of the file specified by the C2 and exfiltrate these to the C2.
The implant performs checks to verify its execution on an allowed endpoint. The implant uses a variety of criteria to identify a blocklisted system by utilizing: Process name blocklists Network adapter name blocklists MAC Address blocklists Analysis tool names blocklists
The keylogger plugin monitors the state of all the alphanumeric keys pressed.
The screen capture plugin will capture the current foreground window (every second or so) and save the screenshot to a .tmp file in a hardcoded directory.
141 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named malware referenced as part of past attack cases connected to Xctdoor.
Remote access trojan referenced in connection with past attack cases linked to Xctdoor.
HTTP 기반 C2 통신을 사용하는 백도어로, 시스템 정보 수집, 파일 작업, 명령 실행, 추가 페이로드 다운로드, 사용자 파일 압축 및 탈취 기능을 지원한다. 정상 프로세스 인젝션과 RegSvr32 기반 지속성을 사용하며 Xctdoor 초기 버전 및 Hansom과 함께 관찰되었다.
Backdoor malware communicating over HTTP that collects system information, performs file operations, executes commands, downloads additional payloads, compresses and exfiltrates files, and maintains persistence via LNK/Run key mechanisms. It was used in earlier Korea-focused campaigns and linked to later Xctdoor activity.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.