Procedure examples

MarkiRAT can upload data from the victim's machine to the C2 server.

MarkiRAT can retrieve the victim’s username.

MarkiRAT can masquerade as update.exe and svehost.exe; it has also mimicked legitimate Telegram and Chrome files.

MarkiRAT can exfiltrate locally stored data via its C2.

MarkiRAT can capture all keystrokes on a compromised host.

MarkiRAT can search for different processes on a system.

MarkiRAT can utilize cmd.exe to execute commands in a victim's environment.

MarkiRAT can initiate communication over HTTP/HTTPS for its C2 server.

MarkiRAT can store collected data locally in a created .nfo file.

MarkiRAT can obtain the computer name from a compromised host.

MarkiRAT can look for files carrying specific extensions such as: .rtf, .doc, .docx, .xls, .xlsx, .ppt, .pptx, .pps, .ppsx, .txt, .gpg, .pkr, .kdbx, .key, and .jpb.

MarkiRAT can download additional files and tools from its C2 server, including through the use of BITSAdmin.

MarkiRAT can run the ShellExecuteW API via the Windows Command Shell.

MarkiRAT can capture screenshots that are initially saved as ‘scr.jpg’.

MarkiRAT can capture clipboard content.

MarkiRAT can use BITS Utility to connect with the C2 server.

MarkiRAT can check for the Telegram installation directory by enumerating the files on disk.

MarkiRAT can check for running processes on the victim’s machine to look for Kaspersky and Bitdefender antivirus products.

MarkiRAT can drop its payload into the Startup directory to ensure it automatically runs when the compromised system is started.

MarkiRAT can modify the shortcut that launches Telegram by replacing its path with the malicious payload to launch with the legitimate executable.

MarkiRAT can gather information from the Keepass password manager.

MarkiRAT can use the GetKeyboardLayout API to check if a compromised host's keyboard is set to Persian.