S1241 RatMilad

malwareMobile

platformsAndroid

also known asRatMilad

RatMilad is an Android remote access tool (RAT) with spyware functionality that has been used to target enterprise mobile devices in the Middle East since at least 2021. Variants of RatMilad have been disguised as VPN applications and a fake app named NumRent. Upon installation, RatMilad employs multiple Collection techniques to collect sensitive information before uploading the collected data to its command and control (C2) server.

techniques used (18)

ATT&CK techniques this enables or maps to.

T1407Download New Code at Runtime
T1414Clipboard Data
T1418Software Discovery
T1420File and Directory Discovery
T1422System Network Configuration Discovery
T1426System Information Discovery
T1429Audio Capture
T1430Location Tracking
T1437.001Web Protocols
T1512Video Capture
T1533Data from Local System
T1636.002Call Log
T1636.003Contact List
T1636.004SMS Messages
T1636.005Accounts
T1646Exfiltration Over C2 Channel
T1660Phishing
T1662Data Destruction

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan