Procedure examples

Cardinal RAT can communicate over multiple C2 host and port combinations.

Cardinal RAT contains watchdog functionality that periodically ensures HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load is set to point to its executable.

Cardinal RAT and its watchdog component are compiled and executed after being delivered to victims as embedded, uncompiled source code.

Cardinal RAT encodes many of its artifacts and is encrypted (AES-128) when downloaded.

Cardinal RAT can collect the username from a victim machine.

Cardinal RAT injects into a newly spawned process created from a native Windows executable.

Cardinal RAT can log keystrokes.

Cardinal RAT contains watchdog functionality that ensures its process is always running, else spawns a new instance.

Cardinal RAT can execute commands.

Cardinal RAT can uninstall itself, including deleting its executable.

Cardinal RAT is downloaded using HTTP over port 443.

Cardinal RAT can collect the hostname, Microsoft Windows version, and processor architecture from a victim machine.

Cardinal RAT checks its current working directory upon execution and also contains watchdog functionality that ensures its executable is located in the correct path (else it will rewrite the payload).

Cardinal RAT can act as a reverse proxy.

Cardinal RAT can download and execute additional payloads.

Cardinal RAT sets HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load to point to its executable.

Cardinal RAT can capture screenshots.

Cardinal RAT decodes many of its artifacts and is decrypted (AES-128) after being downloaded.

Cardinal RAT lures victims into executing malicious macros embedded within Microsoft Excel documents.

Cardinal RAT establishes Persistence by setting the HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load Registry key to point to its executable.

Cardinal RAT applies compression to C2 traffic using the ZLIB library.

Cardinal RAT uses a secret key with a series of XOR and addition operations to encrypt C2 traffic.