S0694 DRATzarus

malwareEnterprise

platformsWindows

also known asDRATzarus

DRATzarus is a remote access tool (RAT) that has been used by Lazarus Group to target the defense and aerospace organizations globally since at least summer 2020. DRATzarus shares similarities with Bankshot, which was used by Lazarus Group in 2017 to target the Turkish financial sector.

techniques used (13)

ATT&CK techniques this enables or maps to.

T1005Data from Local System
T1018Remote System Discovery
T1027Obfuscated Files or Information
T1027.002Software Packing
T1033System Owner/User Discovery
T1036.005Match Legitimate Resource Name or Location
T1057Process Discovery
T1071.001Web Protocols
T1105Ingress Tool Transfer
T1106Native API
T1124System Time Discovery
T1497.003Time Based Checks
T1622Debugger Evasion

used by campaigns (1)

Campaigns that use this.

C0022Operation Dream Job

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan