CISA ComRAT Oct 2020

ComRAT has encrypted its virtual file system using AES-256 in XTS mode.

ComRAT has embedded a XOR encrypted communications module inside the orchestrator module.

ComRAT has used encryption and base64 to obfuscate its orchestrator code in the Registry. ComRAT has also used encoded PowerShell scripts.

ComRAT has stored encrypted orchestrator code and payloads in the Registry.

ComRAT has used a scheduled task to launch its PowerShell loader.

ComRAT has injected its orchestrator DLL into explorer.exe. ComRAT has also injected its communications module into the victim's default browser to make C2 connections appear less suspicious as all network connections will be initiated by the browser process.

ComRAT has used PowerShell to load itself every time a user logs in to the system. ComRAT can execute PowerShell scripts loaded into memory or from the file system.

ComRAT has used HTTP requests for command and control.

ComRAT has the ability to use the Gmail web UI to receive commands and exfiltrate information.

ComRAT has modified Registry values to store encrypted orchestrator code and payloads.

ComRAT has checked the victim system's date and time to perform tasks during business hours (9 to 5, Monday to Friday).

ComRAT has used unique per machine passwords to decrypt the orchestrator payload and a hardcoded XOR key to decrypt its communications module. ComRAT has also used a unique password to decrypt the file used for its hidden file system.

ComRAT can use SSL/TLS encryption for its HTTP-based C2 channel. ComRAT has used public key cryptography with RSA and AES encrypted email attachments for its Gmail C2 channel.