Woody RAT
Software · ATTACK:enterprise:S1065
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1065",
"title": "Woody RAT",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1065",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--3bc7e862-5610-4c02-9c48-15b2e2dc1ddb",
"external_id": "S1065",
"domain": "enterprise",
"created": "2023-02-14T16:52:39.925Z",
"modified": "2025-10-21T03:29:54.769Z",
"version": "1.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "MalwareBytes WoodyRAT Aug 2022",
"url": "https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"
}
]
}Explicit source assertions (30)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--06ab6825-89f4-4bb7-8c82-ae9a5d4cdf61
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--147cd553-fd25-46ea-83ed-594cdb82c440
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c0acd9f-d536-47ec-9473-5d2a5e5dde73
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1055.012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1fdf1686-f498-460a-8948-a5ca46f52b62
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--303ff42e-09fa-49ab-9fa3-420aedb090dc
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--31728aa8-de3d-4edd-8c39-3d9d3091341a
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--344bbf55-0316-49d0-a5ab-c5f79d218908
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--368510dc-1050-45df-81f2-1fca6118c2b0
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--374d1cee-7c9c-4b3b-8e75-8a5c4caf9d47
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1680
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c8805ff-7345-4763-9757-6a30acfe652c
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d2cc737-7cbc-476f-afbe-a8fafa7043fe
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1087
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--642039f8-984e-432d-a6a3-bc6b4469bba0
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71bc9a2e-4536-4b84-9997-126cc4c065bf
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--85fda77f-5129-4de7-bc44-f81ccc46f6d9
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--883822b2-c788-4a60-b9ad-e73e363b1ea6
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--88e52860-d4cc-485a-b23f-ad2cda301727
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1573.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8989ead1-c778-4645-8d95-2d42d875788b
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b714bbe-2a8e-4673-b840-ca5e93a57b1d
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1055
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--90e6cb2a-55c4-4533-bbdc-b8eed2132344
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9e47155f-7b98-4fc5-84b3-01bd70418b8e
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9e92ab98-b547-4206-8158-a186f7570550
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a06f76b9-1920-4660-a2f3-cc0db8d585c0
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6d53c2b-a2d2-4ad6-a61b-b8c88927d66a
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b2191a9b-4963-4fc1-8056-75908795a1af
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b883f2f6-cb3d-4f49-ab42-1fe0b9362ff4
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c9e36653-29fe-4430-b022-cbc855a85f9d
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1203
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dac35c07-4a4a-4924-a702-09e5cf988349
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e611b2ca-ecb4-47f4-acc2-614d37926d5b
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1518
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f372cb23-0736-4cbb-8ba0-3388599226f9
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fa50bbff-2f2f-47a8-b295-588e61b76a77
MalwareBytes WoodyRAT Aug 2022