RadRAT: An all-in-one toolkit for complex espionage ops
summary
Malware named RadRAT is active since at least 2015 and combines 92 commands with two main service DLLs that run as Windows services and switch behavior by filename to achieve rootkit-like injection. It steals credentials via NTLM hash/pass‑the‑hash and application decryption, performs ARP poisoning for sniffing, and uses hard‑coded DNS servers plus Dropbox/Google Drive IP fetches for C2. Telemetry shows ~24 hosts across ~60 IPs concentrated in New Delhi, targeting energy and related companies; attacker compiles and tests builds from six dev IPs in the same region.
AI-written summary · about
chapters (9)
- 0:00Introduction and background
- 1:07About RadRAT malware
- 2:36Malware features and components
- 6:13Command and control communication
- 8:20Credential harvesting techniques
- 10:27Lateral movement operations
- 11:51Malware timeline and telemetry
- 14:40Automated testing discovery
- 15:21Closing remarks and resources
related talks
18mSchrödinger’s RAT: Profiling Stakeholders in the Remote Access Trojan Ecosystem
49mxRAT
31mHacking People’s Mind: When Threat Actors Master Social Engineering
47mDetecting and analyzing files-less malware
26mTracking the World's Dumbest Cyber Mercenaries
27mFrom RATs to Extorting Multibillion Companies: The Evolution of a Modern Ransomware Group
42mThe Next Gen PlugX/ShadowPad? A Dive into the Emerging China-Nexus Modular Trojan, Pangolin8RAT
33mOperation GamblingPuppet: Analysis of a Multivector and Multiplatform Campaign Targeting Online ...