ComRAT
Software · ATTACK:enterprise:S0126
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0126",
"title": "ComRAT",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0126",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--da5880b4-f7da-4869-85f2-e0aba84b8565",
"external_id": "S0126",
"domain": "enterprise",
"created": "2017-05-31T21:33:13.252Z",
"modified": "2025-04-16T20:38:37.924Z",
"version": "1.4",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "ESET ComRAT May 2020",
"url": "https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"
},
{
"source_name": "NorthSec 2015 GData Uroburos Tools",
"url": "https://docplayer.net/101655589-Tools-used-by-the-uroburos-actors.html"
},
{
"source_name": "Symantec Waterbug",
"url": "https://www.threatminer.org/report.php?q=waterbug-attack-group.pdf&y=2015#gsc.tab=0&gsc.q=waterbug-attack-group.pdf&gsc.page=1"
}
]
}Explicit source assertions (23)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1071.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b2b0719-c82e-4d1f-b34c-7ed5dd5c8968
ESET ComRAT May 2020ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1564.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--150e1b1c-a575-4542-a66e-c1646212744b
ESET ComRAT May 2020ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1782abeb-8d28-42a1-8abe-c137f23b282c
NorthSec 2015 GData Uroburos Tools · ESET ComRAT May 2020 · CISA ComRAT Oct 2020ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--19153106-5607-4cac-91a5-c2a900bc5343
ESET ComRAT May 2020 · CISA ComRAT Oct 2020ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1573.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--217ad0a6-f693-416e-9ae4-bcc0c533ce9f
ESET ComRAT May 2020 · CISA ComRAT Oct 2020ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1518
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--31029adf-2b28-4d7f-bdd3-b07f55374eae
ESET ComRAT May 2020ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0126
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--35a9c64c-c305-46bf-a216-c8bb1b051614
Unit 42 IronNetInjector February 2021 · Secureworks IRON HUNTER Profile · Symantec WaterbugATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1055.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--39647c47-c73d-4da7-9b1a-8c67f20c1890
ESET ComRAT May 2020 · CISA ComRAT Oct 2020ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3a86072e-4ca6-4b5d-bf31-b17c250f572e
CISA ComRAT Oct 2020 · ESET ComRAT May 2020ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--414a365a-e24b-44f2-8130-77435f2e18ef
CISA ComRAT Oct 2020 · ESET ComRAT May 2020ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1027.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--488fe004-cb37-4e15-a847-99c32b4fd757
CISA ComRAT Oct 2020 · ESET ComRAT May 2020ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1029
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--55465e2f-104a-440e-aa6b-24f1476fc86d
ESET ComRAT May 2020ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1546.015
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--64309b21-2dc2-4369-9c70-66f47f5c4b56
NorthSec 2015 GData Uroburos ToolsATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1102.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6ff34c78-2c85-4be5-b3db-0ec8543087d9
ESET ComRAT May 2020 · CISA ComRAT Oct 2020ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7eaf474f-7755-41d7-96c6-811889457be2
ESET ComRAT May 2020ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9800fd7a-d2e1-4188-a991-7b8e09edaa13
ESET ComRAT May 2020ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ad8fdfa4-5e0b-437d-9723-9bc5a272f465
ESET ComRAT May 2020 · CISA ComRAT Oct 2020ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b511900a-9bfe-4f8c-b1e2-b95669a5eaeb
ESET ComRAT May 2020ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bdac1391-310e-4511-b272-b80924166723
ESET ComRAT May 2020 · CISA ComRAT Oct 2020ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c2496cf4-b502-44cf-ae85-efb9b882a4b1
CISA ComRAT Oct 2020 · ESET ComRAT May 2020ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c7c1411a-42c8-4d7e-9b56-0465370759de
CISA ComRAT Oct 2020ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1027.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d27ca417-0ced-4e42-b81c-fe93cfe7e1c7
CISA ComRAT Oct 2020 · ESET ComRAT May 2020ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f4303403-0d93-4267-ba4c-a1d4e20d87cd
ESET ComRAT May 2020