DRATzarus
- ID
- S0694
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 17 Apr 2025
DRATzarus is a remote access tool (RAT) that has been used by Lazarus Group to target the defense and aerospace organizations globally since at least summer 2020. DRATzarus shares similarities with Bankshot, which was used by Lazarus Group in 2017 to target the Turkish financial sector.[1]
Techniques used (13)
- T1005 Data from Local System
- T1018 Remote System Discovery
- T1027 Obfuscated Files or Information
- T1027.002 Software Packing
- T1033 System Owner/User Discovery
- T1036.005 Match Legitimate Resource Name or Location
- T1057 Process Discovery
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1106 Native API
- T1124 System Time Discovery
- T1497.003 Time Based Checks
- T1622 Debugger Evasion