{
  "family": "xtrat",
  "sample_count": 35969,
  "category": "rat",
  "description": "Xtreme RAT (also known as XTRAT and ExtRat) is a Windows remote access trojan. As documented by Malpedia (Fraunhofer FKIE), which cites Trend Micro, it is a backdoor that allows a remote attacker to steal information and control an infected system. It has been used in targeted attacks, including 2012 campaigns against Israeli and Syrian government targets, and is associated with the Molerats threat actor. Its capabilities include file management (downloading, uploading, and executing files), registry management, executing shell commands, computer control (such as shutdown and logging the user on or off), screen capture, and logging keystrokes on infected systems.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "xtreme rat",
    "xtremerat",
    "xrat"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Xtreme RAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Xtreme RAT (XTRAT, ExtRat) is a Windows remote access trojan and backdoor. According to Malpedia, citing Trend Micro, it lets a remote attacker steal information from and control an infected computer."
      }
    },
    {
      "@type": "Question",
      "name": "What can Xtreme RAT do on an infected system?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Per Malpedia's description, Xtreme RAT can receive commands to manage files (download, upload, and execute), manage the Windows registry (add, delete, query, and modify keys), run shell commands, control the computer (including shutdown and logging the user on or off), capture the screen, and log keystrokes."
      }
    },
    {
      "@type": "Question",
      "name": "What has Xtreme RAT been used for?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Malpedia notes that Xtreme RAT has been used in targeted attacks, including 2012 campaigns against Israeli and Syrian government targets, and associates the family with the Molerats threat actor."
      }
    },
    {
      "@type": "Question",
      "name": "Is Xtreme RAT a keylogger?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Keylogging is one of its capabilities. Malpedia states that, in addition to its backdoor command features, Xtreme RAT can log the keystrokes of infected systems, which can be used to capture credentials and other typed information."
      }
    },
    {
      "@type": "Question",
      "name": "What other names is Xtreme RAT known by?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Malpedia lists the family under the symbol win.extreme_rat with the common name Xtreme RAT and the alias ExtRat. It is also commonly abbreviated XTRAT in antivirus detections."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1056.001",
    "T1113",
    "T1125",
    "T1105",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-10",
  "sources": [
    {
      "name": "Malpedia (Fraunhofer FKIE): Xtreme RAT (win.extreme_rat)",
      "url": "https://malpedia.caad.fkie.fraunhofer.de/details/win.extreme_rat"
    }
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}