{
  "family": "xrat",
  "sample_count": 4,
  "category": "trojan",
  "description": "Backdoor:Win32/Xrat (widely known as **XtremeRAT** or XRAT) is a highly capable, commercially available Remote Access Trojan (RAT). While originally marketed as a legitimate remote administration tool, it has been heavily cracked, weaponized, and adopted by both low-level cybercriminals and sophisticated Advanced Persistent Threat (APT) groups (such as the Gaza Cybergang). XtremeRAT provides an attacker with complete, interactive, and invisible control over a compromised Windows host.<br><br><b>Understanding XtremeRAT</b><br>To an end-user, an XtremeRAT infection is entirely silent. There are no pop-ups or performance issues. For a SOC analyst, detecting XtremeRAT is a 'Code Red' incident. It means a human operator potentially has interactive, real-time access to the network and can bypass multi-factor authentication by acting directly from the compromised user's session.<br><br><b>Execution and Interactive Control</b><br>XtremeRAT is typically delivered via spear-phishing campaigns containing malicious attachments (`T1566.001`) or via exploit kits. Once the payload is executed, it establishes persistence, often by creating a hidden service or modifying the Registry Run keys (`T1543.003`). It then initiates an encrypted, outbound connection to the attacker's Command and Control (C2) server (`T1573`). The XtremeRAT control panel provides the attacker with a vast array of capabilities: they can view the live desktop (`T1113`), capture all keystrokes (`T1056.001`), access the webcam and microphone (`T1125`), upload/download files (`T1048`), and execute arbitrary commands in a hidden remote shell (`T1059.003`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of confidentiality and integrity for the host, and a high likelihood of lateral movement. Host-based IoCs include EDR alerts for anomalous services being created, unexpected processes injecting code into `explorer.exe`, or rapid, unauthorized access to sensitive files. Network IoCs include consistent, long-lived, encrypted beaconing traffic (often on non-standard ports) to dynamic DNS providers (like No-IP or DynDNS) frequently used by RAT operators.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1056.001",
    "T1113",
    "T1573",
    "T1059.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1113",
      "name": "Screen Capture (Live desktop viewing)",
      "tactic": "Collection"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1573",
      "name": "Encrypted Channel (C2 communication)",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Immediately physically isolate the endpoint from the network to sever the attacker's interactive, real-time control over the machine.",
    "Assume all credentials typed on the machine (and any active session tokens) are compromised; initiate immediate, enterprise-wide password resets.",
    "Perform deep memory forensics to extract the XtremeRAT configuration, which often contains the C2 IP address, campaign IDs, and encryption passwords.",
    "Review network logs retroactively to identify exactly when the C2 connection was first established and what data may have been exfiltrated."
  ],
  "what_to_avoid": [
    "Do not leave the machine connected to the network while investigating; the attacker is likely watching your actions live via the RAT.",
    "Avoid relying solely on file deletion; XtremeRAT often utilizes process injection, meaning the malicious code resides in the memory of legitimate processes."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}