S1182 MagicRAT

malwareEnterprise

platformsWindows

also known asMagicRAT

MagicRAT is a remote access tool developed in C++ and exclusively used by the Lazarus Group threat actor in operations. MagicRAT allows for arbitrary command execution on victim machines and provides basic remote access functionality.

techniques used (13)

ATT&CK techniques this enables or maps to.

T1016System Network Configuration Discovery
T1027.013Encrypted/Encoded File
T1036.005Match Legitimate Resource Name or Location
T1036.008Masquerade File Type
T1041Exfiltration Over C2 Channel
T1053.005Scheduled Task
T1059.003Windows Command Shell
T1070.004File Deletion
T1071.001Web Protocols
T1082System Information Discovery
T1105Ingress Tool Transfer
T1140Deobfuscate/Decode Files or Information
T1547.001Registry Run Keys / Startup Folder

used by groups (1)

Threat groups associated with this.

G0032Lazarus Group

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan