{
  "family": "prorat",
  "sample_count": 14,
  "category": "trojan",
  "description": "Backdoor:Win32/ProRat is a classic, highly infamous Remote Access Trojan (RAT) originating from Turkey in the mid-2000s. Widely distributed on hacker forums, ProRat was heavily utilized by script kiddies and low-tier cybercriminals. It is notorious for its destructive 'joke' payloads, its aggressive system subversion techniques, and its comprehensive suite of espionage tools.<br><br><b>Understanding ProRat</b><br>To a victim, a ProRat infection often manifests as bizarre and terrifying computer behavior: the CD-ROM drive opening and closing, the mouse moving on its own, the screen flipping upside down, or sudden Blue Screens of Death (BSOD). For a security analyst, ProRat represents a noisy but highly capable backdoor. Once installed, it grants a remote attacker complete, GUI-based administrative control over the infected machine, allowing for data theft, keylogging, and the deployment of further malware.<br><br><b>Execution and Remote Control Mechanics</b><br>ProRat consists of a 'Client' (used by the attacker) and a 'Server' (the malware payload deployed to the victim). The server payload was typically disguised as a game, a crack, or a picture, and distributed via spam or P2P networks (`T1204.002`). Upon execution, it aggressively establishes persistence, often copying itself to the Windows directory and creating multiple Registry Run keys (`T1547.001`). To evade detection, it utilizes rootkit-like techniques (often injecting into `explorer.exe`) to hide its process, files, and the open network port (`T1055`). It opens a listening port (default was often TCP 5110) and waits for the attacker to connect (`T1090`). The attacker then uses the ProRat Client GUI to execute commands: logging keystrokes (`T1056.001`), stealing saved passwords, capturing webcam footage, or executing destructive 'fun' commands that disable the keyboard or format drives.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total endpoint compromise, data theft, and severe disruption of services. Incident responders will observe anomalous listening ports (e.g., 5110) and inbound connections from unknown IPs. EDR logs will flag unauthorized modifications to the Registry, the creation of hidden files in the Windows folder, and the injection of code into standard system processes.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1056.001",
    "T1491",
    "T1547.001",
    "T1090",
    "T1055"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Credential Access"
    },
    {
      "id": "T1090",
      "name": "Connection Proxy (Listening Port)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1491",
      "name": "Defacement (UI Manipulation/Joke Payloads)",
      "tactic": "Impact"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network; an active adversary is likely controlling the machine and may be viewing the screen.",
    "Assume all local credentials, passwords, and sensitive files on the machine have been stolen or compromised.",
    "Do not attempt to 'clean' the machine manually; ProRat utilizes aggressive hiding techniques and often drops secondary backdoors.",
    "Perform a complete bare-metal rebuild of the operating system after capturing forensic evidence (RAM dump and disk image)."
  ],
  "what_to_avoid": [
    "Do not engage with the attacker if they initiate a chat session through the RAT; immediately disconnect the network cable.",
    "Avoid relying solely on software firewalls to block the connection, as ProRat actively attempts to disable or bypass local security software."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}