Remote Access Trojan (RAT).

What Is a Remote Access Trojan?

A remote access trojan, often shortened to RAT, is malware that gives an attacker remote control over a computer. The word trojan points to the disguise. The word remote access points to the goal. MITRE ATT&CK calls gh0st RAT a remote access tool. Its entry says the source code is public and several groups have used it.

The letters RAT are also used for the phrase remote access tool. Both versions of the name appear in practice, and they refer to the same idea of controlling a machine from afar.

How Does a RAT Work?

MITRE lists what the gh0st RAT can do. Its capabilities include remote command execution, file operations, system reconnaissance and keylogging. It also includes persistence through registry changes and service creation. MITRE also notes that it uses encrypted communications to hide its command and control traffic. Command and control is the link an attacker uses to send orders to the infected machine and receive results.

Not every RAT has the same features. This list describes one documented example, not all of them.

Why Is a Public RAT Not a Sign of One Group?

A RAT gives an attacker an interactive foothold on a machine. MITRE lists remote command execution, file operations and keylogging for one example, so a single infected computer can expose files and typed information. Because the code of the gh0st RAT is public and used by multiple groups, a tool of this kind is not limited to one actor. Defenders therefore should not treat a RAT as a sign of a single known group.

How Do You Spot Unapproved Remote Control?

MITRE also describes a related technique called remote access tools, where adversaries use legitimate remote access software to set up interactive command and control. MITRE says such software may be installed after a compromise as an alternate communications channel. It adds that installing many of these tools can include persistence, for example when the installer creates a Windows service.

• Know which remote access software is approved in your organization, so unapproved tools stand out.
• Review services and registry changes for entries nobody can explain.
• Watch for network traffic to destinations that make no sense for the machine.
• Treat an unexpected remote session as a possible sign of compromise.
• Keep approved remote access software patched too. In TeamViewer before 15.83, a malicious host could attack the technician who connects to it, as our TeamViewer update guide for support teams explains.

What Does gh0st RAT Do on a Machine?

MITRE ties these techniques to gh0st RAT. They work as a checklist of traces. Remote tools also connect to remote services and valid accounts.

Is a RAT the Same as Legitimate Remote Access Software?

No, though they can look alike. Legitimate remote access software is made for support and administration. MITRE notes that adversaries abuse such software after a compromise. A RAT is malware, and it is installed without the owner’s knowledge. The difference is consent, not the technology.

Is a RAT the Same as a Backdoor?

They overlap. A backdoor is any hidden way into a system. A RAT is a specific kind of program that offers remote control, and it can serve as a backdoor.

Related Terms

See also trojan, backdoor and command and control. For our own research, read the Xeno RAT analysis.

Related Pages in the Knowledge Hub

• Gh0st RAT

Sources

• MITRE ATT&CK: MITRE describes gh0st RAT as a remote access tool with public source code used by multiple groups, with remote command execution, file operations, keylogging and persistence.
• MITRE ATT&CK: MITRE says remote access tools may be installed post-compromise as an alternate communications channel, and installation can include persistence such as a Windows service.