Skip to main content

ObliqueRAT Remote Access Trojan

ObliqueRAT is a newly observed remote access trojan targeting diplomatic and governmental organisations. Despite operating primarily throughout Southeast Asia, it has begun to appear in campaigns in Central and Western Europe.

Threat ID:
CC-3379
Category:
Trojan
Threat Severity:
Medium
Threat Vector:
Email spam
Published:
25 February 2020 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

ObliqueRAT is a newly observed remote access trojan targeting diplomatic and governmental organisations. Despite operating primarily throughout Southeast Asia, it has begun to appear in campaigns in Central and Western Europe.

Affected platforms

The following platforms are known to be affected:

Microsoft Windows

  • Microsoft Windows - All versions

Threat details

Initial delivery of ObliqueRAT is achieved via macro-enabled Microsoft Office documents distributed in small-scale spam campaigns tailored for specific targets. These documents contain a VBA script along with a form or textbook containing an embedded ObliqueRAT binary file. When opened, the script will unpack and drop the binary before creating a shortcut in the Startup folder to ensure persistence.

Once installed, ObliqueRAT will perform anti-infection checks and creates a mutex to ensure only one instance of itself is running. It then attempts to gather user and system, storing it until requested, before connecting to a command and control server using a hard-coded IP address and port. At the time of publication, ObliqueRAT is has the following capabilities:

  • file creation, deletion, and extraction
  • secondary payload installation
  • process termination
  • command execution
  • network enumeration

Remediation steps

Type Step

To prevent and detect a trojan infection, NHS Digital advises that:

  • Secure configurations are applied to all devices.
  • Security updates are applied at the earliest opportunity.
  • Tamper protection settings in security products are enabled where available.
  • Obsolete platforms are segregated from the rest of the network.
  • IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
  • Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
  • Administrative accounts are only used for necessary purposes.
  • Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
  • Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.

Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.

Indicators of compromise

Main indicators

IP Addresses

  • 185.117.73[.]222:3344

SHA256 File Hashes

  • 057da080ae0983585ae21195bee60d82664355a7fd78c25f21791b165c250212
  • 37c7500ed49671fe78bd88afa583bfb59f33d3ee135a577908d633b4e9aa4035
  • 4a25e48b8cf515f4cdd6711a69ccc875429dcc32007adb133fb25d63e53e2ac6
  • 9da1a55b88bda3810ccd482051dc7e0088e8539ef8da5ddd29c583f593244e1c
  • ad17ada0171b9e619000902e62b26b949afb01b974a65258e4a7ecd59c248dba
  • dfad2a80dac91e7703266197ebbf5d67ef77467ab341dd491ad25d92d8118cac

Last edited: 29 June 2021 12:00 pm