MalwareUsed by 1 actor

CrossRAT

CrossRAT is a Java-based, cross-platform remote access backdoor associated with the Dark Caracal cyber-espionage operation. It targets Windows, macOS, and Linux systems and provides persistent remote command-and-control access to infected hosts. Reported targeting linked to the broader operation included governments, militaries, utilities, financial institutions, manufacturing companies, defense contractors, and other individuals and organizations across multiple countries.

CrossRAT performs host profiling and transmits basic system information to its command infrastructure, including operating system details, username, and hostname. Its supported tasking includes filesystem enumeration and manipulation, creating, copying, moving, reading, and writing files, taking screenshots, and executing additional files or payloads. On Windows, execution of secondary content has been observed through native system utilities, while non-Windows variants can open or execute files through platform desktop functionality.

Persistence is implemented using native mechanisms on each supported platform. On Windows, CrossRAT uses Registry Run keys. On macOS, it creates a LaunchAgent. On Linux, it creates an autostart desktop entry. The malware copies itself to a persistent JAR location and relies on the presence of Java on the victim system. CrossRAT has been characterized as a surveillance-oriented implant and a multiplatform espionage backdoor rather than commodity crimeware.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Dark Caracal

"Dark Caracal also uses a previously unknown, multiplatform tool that Lookout and EFF have named CrossRAT, which is able to target Windows, OSX, and Linux."

via objective seeobjective-see.com

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

3 techniques

T1543.001Launch AgentEvidence2

Bundlore can persist via a LaunchAgent. Calisto adds a .plist file to the /Library/LaunchAgents folder to maintain persistence. CoinTicker creates user launch agents named .espl.plist and com.apple.[random string].plist to establish persistence.

T1547.001Registry Run Keys / Startup FolderEvidence7

ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.

T1547.013XDG Autostart EntriesEvidence1

Privilege Escalation

3 techniques

T1543.001Launch AgentEvidence2

T1547.001Registry Run Keys / Startup FolderEvidence7

T1547.013XDG Autostart EntriesEvidence1

Discovery

1 technique

T1083File and Directory DiscoveryEvidence5

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

Collection

1 technique

T1113Screen CaptureEvidence4

The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app8 years ago

hash.md5●●●●●●●●●●●●View more in app9 years ago

ACTIVITY FEED

Recent activity

13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

13 SOURCESView more in app

mitre attack websiteNews

Oct 21, 2021

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Sub-technique T1547.001 - Enterprise | MITRE ATT&CK®

Remote access trojan that persists on Windows via Run keys.

mitre attack websiteNews

Oct 21, 2021

Screen Capture, Technique T1113 - Enterprise | MITRE ATT&CK®

Cross-platform remote access trojan capable of screen capture.

mitre attack websiteNews

Jan 1, 2021

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Sub-technique T1547.001 - Enterprise | MITRE ATT&CK®

Remote access trojan that persists on Windows via Run keys.

mitre attack websiteNews

Jan 1, 2021

Screen Capture, Technique T1113 - Enterprise | MITRE ATT&CK®

Remote access trojan capable of taking screen captures.

+9 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

CrossRAT