LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0126: ComRAT

ComRAT is a second stage implant suspected of being a descendant of Agent.btz and used by Turla. The first version of ComRAT was identified in 2007, but the tool has undergone substantial development for many years since.[1][2][3]

EnterpriseS0126MalwareObject v1.4Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

ComRAT is a Windows second-stage implant associated in ATT&CK with Turla and described as having evolved over many years from earlier Agent.btz lineage. Its business significance is not a single malware signature; it is the combination of stealth, persistence, discovery, command-and-control, and scheduled transfer behaviors that can allow a long-running intrusion to remain operational after initial access. For leaders, this object is a reminder to validate whether Windows endpoint, registry, scheduled task, PowerShell/cmd, and network C2 telemetry can support an investigation when a mature espionage-style implant is suspected.

Executive priority

Prioritize ComRAT as a resilience and readiness validation case for Windows environments, especially where sensitive government, research, pharmaceutical, military, embassy, education, or similar information risks are material, as those sectors are noted in the related Turla description. The decision value is to confirm whether existing SOC, incident response, identity, endpoint, and network controls can prove or disprove persistence, command execution, registry abuse, obfuscation, and C2 activity—not to assume a specific exposure. This is also useful audit evidence: teams should be able to show that logging, retention, and response playbooks cover scheduled tasks, registry modifications, command interpreters, and suspicious web or mail protocol communications.

Technical view

ATT&CK provides no official detection text for ComRAT, so defenders should validate coverage through the related behaviors. On Windows, focus on registry query and modification activity, scheduled task creation or masquerading, COM hijacking indicators, DLL injection evidence, PowerShell and Windows Command Shell execution, native API-driven process activity where observable, software and system time discovery, fileless or hidden storage patterns, obfuscated or embedded payload handling, and network communications using web protocols, mail protocols, legitimate web-service-style bidirectional communication, and asymmetric cryptography. IR teams should correlate endpoint execution and persistence artifacts with outbound network timing, since scheduled transfer is included in the relationships.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry for PowerShell and cmd.exe activity
  • Windows Registry access and modification telemetry, including COM-related registry locations where available
  • Scheduled Task creation, modification, execution, names, descriptions, and parent process context
  • Service or task naming data to identify possible masquerading
  • Endpoint file, memory, and module-load telemetry relevant to DLL injection and embedded or obfuscated payloads

Detection direction

  • Because ATT&CK does not provide official detection guidance for this object, build detections from the related techniques rather than from the malware name alone.
  • Correlate scheduled task creation or modification with suspicious command interpreters, registry changes, or unusual outbound communications.
  • Tune for masquerading by comparing task and service names, descriptions, paths, signers, and execution context against known-good administrative baselines.
  • Review registry query and modification patterns in combination with persistence behaviors such as COM hijacking or fileless storage, rather than treating all registry access as suspicious.
  • Hunt for obfuscated command lines, encoded content, embedded payload indicators, and deobfuscation or decoding behavior, while accounting for legitimate administration and software deployment tools.

Mitigation priorities

  • Ensure Windows logging and retention are sufficient before relying on malware-specific alerts: process creation, PowerShell, registry, scheduled task, and network metadata are foundational.
  • Harden and monitor persistence surfaces related to scheduled tasks, services, COM references, and registry autorun-style locations according to least privilege and change-control practices.
  • Limit unnecessary script and command interpreter abuse through administrative controls, PowerShell logging, constrained administration, and review of legitimate automation paths.
  • Maintain endpoint protection and response capability that can inspect obfuscation, embedded payloads, suspicious module loads, and process injection behaviors where supported.
  • Baseline normal web and mail protocol egress, then restrict or review unusual outbound communications from servers and workstations that should not initiate them.
Additional notes and limits

The supplied ATT&CK object identifies ComRAT as a Windows second-stage implant used by Turla, with external reporting from Symantec, G Data/NorthSec, and ESET. The relationship set is rich and points to behaviors spanning discovery, execution, persistence, privilege escalation, defense evasion/stealth, command-and-control, and exfiltration-related scheduling. Use this object as a threat-informed validation scenario for mature Windows intrusion response rather than as a standalone indicator list.

MITRE provides no official detection section for this object, and the object itself lists no tactics. Several related techniques have broader platform lists, but the ComRAT object platform is Windows, so local validation should center on Windows evidence unless separate intelligence supports other platforms. This take does not assert current exploitation, customer exposure, or confirmed detection coverage; environment-specific telemetry and investigation data are required.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

ComRAT

ComRAT is a second stage implant suspected of being a descendant of Agent.btz and used by Turla. The first version of ComRAT was identified in 2007, but the tool has undergone substantial development for many years since.[1][2][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

22 rows
DomainIDNameRelationship / procedure
EnterpriseT1071.003Mail ProtocolsSub-technique

ComRAT can use email attachments for command and control.[3]

EnterpriseT1564.005Hidden File SystemSub-technique

ComRAT has used a portable FAT16 partition image placed in %TEMP% as a hidden file system.[3]

EnterpriseT1071.001Web ProtocolsSub-technique

ComRAT has used HTTP requests for command and control.[2][3][4]

EnterpriseT1053.005Scheduled TaskSub-technique

ComRAT has used a scheduled task to launch its PowerShell loader.[3][4]

EnterpriseT1573.002Asymmetric CryptographySub-technique

ComRAT can use SSL/TLS encryption for its HTTP-based C2 channel. ComRAT has used public key cryptography with RSA and AES encrypted email attachments for its Gmail C2 channel.[3][4]

EnterpriseT1518Software Discovery

ComRAT can check the victim's default browser to determine which process to inject its communications module into.[3]

EnterpriseT1055.001Dynamic-link Library InjectionSub-technique

ComRAT has injected its orchestrator DLL into explorer.exe. ComRAT has also injected its communications module into the victim's default browser to make C2 connections appear less suspicious as all network connections will be initiated by the browser process.[3][4]

EnterpriseT1027Obfuscated Files or Information

ComRAT has encrypted its virtual file system using AES-256 in XTS mode.[3][4]

EnterpriseT1027.011Fileless StorageSub-technique

ComRAT has stored encrypted orchestrator code and payloads in the Registry.[3][4]

EnterpriseT1027.010Command ObfuscationSub-technique

ComRAT has used encryption and base64 to obfuscate its orchestrator code in the Registry. ComRAT has also used encoded PowerShell scripts.[3][4]

EnterpriseT1029Scheduled Transfer

ComRAT has been programmed to sleep outside local business hours (9 to 5, Monday to Friday).[3]

EnterpriseT1546.015Component Object Model HijackingSub-technique

ComRAT samples have been seen which hijack COM objects for persistence by replacing the path to shell32.dll in registry location HKCU\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32.[2]

EnterpriseT1102.002Bidirectional CommunicationSub-technique

ComRAT has the ability to use the Gmail web UI to receive commands and exfiltrate information.[3][4]

EnterpriseT1106Native API

ComRAT can load a PE file from memory or the file system and execute it with CreateProcessW.[3]

EnterpriseT1059.003Windows Command ShellSub-technique

ComRAT has used cmd.exe to execute commands.[3]

EnterpriseT1140Deobfuscate/Decode Files or Information

ComRAT has used unique per machine passwords to decrypt the orchestrator payload and a hardcoded XOR key to decrypt its communications module. ComRAT has also used a unique password to decrypt the file used for its hidden file system.[3][4]

EnterpriseT1012Query Registry

ComRAT can check the default browser by querying HKCR\http\shell\open\command.[3]

EnterpriseT1059.001PowerShellSub-technique

ComRAT has used PowerShell to load itself every time a user logs in to the system. ComRAT can execute PowerShell scripts loaded into memory or from the file system.[3][4]

EnterpriseT1112Modify Registry

ComRAT has modified Registry values to store encrypted orchestrator code and payloads.[3][4]

EnterpriseT1124System Time Discovery

ComRAT has checked the victim system's date and time to perform tasks during business hours (9 to 5, Monday to Friday).[4]

EnterpriseT1027.009Embedded PayloadsSub-technique

ComRAT has embedded a XOR encrypted communications module inside the orchestrator module.[3][4]

EnterpriseT1036.004Masquerade Task or ServiceSub-technique

ComRAT has used a task name associated with Windows SQM Consolidator.[3]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0010: Turla

Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.[1][2][3][4][5]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1071.003: Mail ProtocolsEnterpriseuses · TechniqueT1564.005: Hidden File SystemEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · TechniqueT1573.002: Asymmetric CryptographyEnterpriseuses · TechniqueT1518: Software DiscoveryEnterpriseuses · GroupG0010: TurlaEnterpriseuses · TechniqueT1055.001: Dynamic-link Library InjectionEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · TechniqueT1027.011: Fileless StorageEnterpriseuses · TechniqueT1027.010: Command ObfuscationEnterpriseuses · TechniqueT1029: Scheduled TransferEnterpriseuses · TechniqueT1546.015: Component Object Model HijackingEnterpriseuses · TechniqueT1102.002: Bidirectional CommunicationEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1012: Query RegistryEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1124: System Time DiscoveryEnterpriseuses · TechniqueT1027.009: Embedded PayloadsEnterpriseuses · TechniqueT1036.004: Masquerade Task or ServiceEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.4
Created
Modified
Raw hash
4fa73c98f13f66d0...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.4Current bundle4fa73c98f13f…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Symantec Waterbug

    Symantec. (2015, January 26). The Waterbug attack group. Retrieved April 10, 2015.

    Open source URL
  2. [2]
    NorthSec 2015 GData Uroburos Tools

    Rascagneres, P. (2015, May). Tools used by the Uroburos actors. Retrieved August 18, 2016.

    Open source URL
  3. [3]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  4. [4]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  5. [5]
    Unit 42 IronNetInjector February 2021

    Reichel, D. (2021, February 19). IronNetInjector: Turla’s New Malware Loading Tool. Retrieved February 24, 2021.

    Open source URL
  6. [6]
    Secureworks IRON HUNTER Profile

    Secureworks CTU. (n.d.). IRON HUNTER. Retrieved February 22, 2022.

  7. [7]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  8. [8]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  9. [9]
    NorthSec 2015 GData Uroburos Tools

    Rascagneres, P. (2015, May). Tools used by the Uroburos actors. Retrieved August 18, 2016.

    Open source URL
  10. [10]
    NorthSec 2015 GData Uroburos Tools

    Rascagneres, P. (2015, May). Tools used by the Uroburos actors. Retrieved August 18, 2016.

    Open source URL
  11. [11]
    Symantec Waterbug

    Symantec. (2015, January 26). The Waterbug attack group. Retrieved April 10, 2015.

    Open source URL
  12. [12]
    Symantec Waterbug

    Symantec. (2015, January 26). The Waterbug attack group. Retrieved April 10, 2015.

    Open source URL
  13. [13]
    mitre-attackS0126
    Open source URL
  14. [14]
    mitre-attackS0126
    Open source URL
  15. [15]
    mitre-attackS0126
    Open source URL
  16. [16]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  17. [17]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  18. [18]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  19. [19]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  20. [20]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  21. [21]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  22. [22]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  23. [23]
    NorthSec 2015 GData Uroburos Tools

    Rascagneres, P. (2015, May). Tools used by the Uroburos actors. Retrieved August 18, 2016.

    Open source URL
  24. [24]
    NorthSec 2015 GData Uroburos Tools

    Rascagneres, P. (2015, May). Tools used by the Uroburos actors. Retrieved August 18, 2016.

    Open source URL
  25. [25]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  26. [26]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  27. [27]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  28. [28]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  29. [29]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  30. [30]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  31. [31]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  32. [32]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  33. [33]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  34. [34]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  35. [35]
    Secureworks IRON HUNTER Profile

    Secureworks CTU. (n.d.). IRON HUNTER. Retrieved February 22, 2022.

  36. [36]
    Symantec Waterbug

    Symantec. (2015, January 26). The Waterbug attack group. Retrieved April 10, 2015.

    Open source URL
  37. [37]
    Symantec Waterbug

    Symantec. (2015, January 26). The Waterbug attack group. Retrieved April 10, 2015.

    Open source URL
  38. [38]
    Unit 42 IronNetInjector February 2021

    Reichel, D. (2021, February 19). IronNetInjector: Turla’s New Malware Loading Tool. Retrieved February 24, 2021.

    Open source URL
  39. [39]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  40. [40]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  41. [41]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  42. [42]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  43. [43]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  44. [44]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  45. [45]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  46. [46]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  47. [47]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  48. [48]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  49. [49]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  50. [50]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  51. [51]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  52. [52]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  53. [53]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  54. [54]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  55. [55]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  56. [56]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  57. [57]
    NorthSec 2015 GData Uroburos Tools

    Rascagneres, P. (2015, May). Tools used by the Uroburos actors. Retrieved August 18, 2016.

    Open source URL
  58. [58]
    NorthSec 2015 GData Uroburos Tools

    Rascagneres, P. (2015, May). Tools used by the Uroburos actors. Retrieved August 18, 2016.

    Open source URL
  59. [59]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  60. [60]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  61. [61]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  62. [62]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  63. [63]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  64. [64]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  65. [65]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  66. [66]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  67. [67]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  68. [68]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  69. [69]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  70. [70]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  71. [71]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  72. [72]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  73. [73]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  74. [74]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  75. [75]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  76. [76]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  77. [77]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  78. [78]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  79. [79]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  80. [80]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  81. [81]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  82. [82]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  83. [83]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  84. [84]
    CISA ComRAT Oct 2020

    CISA. (2020, October 29). Malware Analysis Report (AR20-303A). Retrieved December 9, 2020.

    Open source URL
  85. [85]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  86. [86]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
  87. [87]
    ESET ComRAT May 2020

    Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use