Procedure examples

SombRAT has collected data and files from a compromised host.

SombRAT can enumerate services on a victim machine.

SombRAT can encrypt strings with XOR-based routines and use a custom AES storage format for plugins, configuration, C2 domains, and harvested data.

SombRAT can execute getinfo to identify the username on a compromised host.

SombRAT can use a legitimate process name to hide itself.

SombRAT has uploaded collected data and files from a compromised host to its C2 server.

SombRAT can execute loadfromfile, loadfromstorage, and loadfrommem to inject a DLL from disk, storage, or memory respectively.

SombRAT can use the getprocesslist command to enumerate processes on a compromised host.

SombRAT has the ability to run cancel or closeanddeletestorage to remove all files from storage and delete the storage temp file on a compromised host.

SombRAT can communicate over DNS with the C2 server.

SombRAT can store harvested data in a custom database under the %TEMP% directory.

SombRAT can execute getinfo to enumerate the computer name and OS version of a compromised system.

SombRAT can execute enum to enumerate files in storage on a compromised system.

SombRAT has the ability to use an embedded SOCKS proxy in C2 communications.

SombRAT has the ability to use TCP sockets to send data and ICMP to ping the C2 server.

SombRAT has the ability to download and execute additional payloads.

SombRAT has the ability to respawn itself using ShellExecuteW and CreateProcessW.

SombRAT can execute getinfo to discover the current time on a compromised host.

SombRAT can run upload to decrypt and upload files from storage.

SombRAT has encrypted collected data with AES-256 using a hardcoded key.

SombRAT has the ability to modify its process memory to hide process command-line arguments.

SombRAT can use a custom DGA to generate a subdomain for C2.

SombRAT has encrypted its C2 communications with AES.

SombRAT can SSL encrypt C2 traffic.