Critical severity Malware

Remote Access Trojan (RAT)

Gives an attacker an interactive shell, desktop view and file transfer on the victim machine.

Overview

A RAT is a full remote administration tool pointed the wrong way: screen capture, webcam, clipboard, file manager and shell, all behind an icon that looks harmless.\nOperators often rent access out rather than use it themselves, so one infection can become several people's problem.\nApplication allow-listing and outbound C2 detection are the main obstacles.

Indicators of Compromise

Signals that suggest this is present on a system.

Screen-capture or webcam processes with network activity
Startup entries pointing at renamed binaries
Long-lived encrypted sessions to non-corporate hosts

References

Related entries

Trojan High
Fileless Malware Critical
Ransomware Critical
Rootkit Critical

Related glossary terms

CWE
Common Weakness Enumeration. A catalogue of the underlying defect class, for example CWE-8...
Command and Control (C2)
The infrastructure an attacker uses to send instructions to compromised hosts and receive...
Indicator of Compromise (IoC)
A forensic artefact that suggests a system was breached: a file hash, a suspicious domain,...

Check your site anyway

This entry is background reading rather than a scanner check. The free scan still reports the exposures we do cover: security headers, TLS, DNS and domain reputation.

Run a free scan

← All malware