Talos Oblique RAT March 2021

ObliqueRAT has the ability to extract data from removable devices connected to the endpoint.

ObliqueRAT can hide its payload in BMP images hosted on compromised websites.

ObliqueRAT can break large files of interest into smaller chunks to prepare them for exfiltration.

ObliqueRAT can check for blocklisted usernames on infected endpoints.

ObliqueRAT can check for blocklisted process names on a compromised host.

ObliqueRAT can copy specific files, webcam captures, and screenshots to local directories.

ObliqueRAT has the ability to check for blocklisted computer names on infected endpoints.

ObliqueRAT has the ability to recursively enumerate files on an infected endpoint.

ObliqueRAT can capture a screenshot of the current screen.

ObliqueRAT can discover pluggable/removable drives to extract files from.

ObliqueRAT can capture images from webcams on compromised hosts.

Transparent Tribe has directed users to open URLs hosting malicious content.

ObliqueRAT has gained execution on targeted systems through luring users to click on links to malicious URLs.

Transparent Tribe has used weaponized documents in e-mail to compromise targeted systems.

ObliqueRAT can halt execution if it identifies processes belonging to virtual machine software or analysis tools.

ObliqueRAT can gain persistence by a creating a shortcut in the infected user's Startup directory.

Transparent Tribe has sent spearphishing e-mails with attachments to deliver malicious payloads.

Transparent Tribe has embedded links to malicious downloads in e-mails.