ObliqueRAT - S0644 (5864e59f-eb4c-43ad-83b2-b5e4fae056c9)

ObliqueRAT is a remote access trojan, similar to Crimson, that has been in use by Transparent Tribe since at least 2020.(Citation: Talos Oblique RAT March 2021)(Citation: Talos Transparent Tribe May 2021)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
System Information Discovery - T1082 (354a7f88-63fb-41b5-a801-ce3b377b36f1)	Attack Pattern	ObliqueRAT - S0644 (5864e59f-eb4c-43ad-83b2-b5e4fae056c9)	Malware	1
Local Data Staging - T1074.001 (1c34f7aa-9341-4a48-bfab-af22e51aca6c)	Attack Pattern	ObliqueRAT - S0644 (5864e59f-eb4c-43ad-83b2-b5e4fae056c9)	Malware	1
ObliqueRAT - S0644 (5864e59f-eb4c-43ad-83b2-b5e4fae056c9)	Malware	Registry Run Keys / Startup Folder - T1547.001 (9efb1ea7-c37b-4595-9640-b7680cd84279)	Attack Pattern	1
ObliqueRAT - S0644 (5864e59f-eb4c-43ad-83b2-b5e4fae056c9)	Malware	File and Directory Discovery - T1083 (7bc57495-ea59-4380-be31-a64af124ef18)	Attack Pattern	1
Data from Removable Media - T1025 (1b7ba276-eedc-4951-a762-0ceea2c030ec)	Attack Pattern	ObliqueRAT - S0644 (5864e59f-eb4c-43ad-83b2-b5e4fae056c9)	Malware	1
Screen Capture - T1113 (0259baeb-9f63-4c69-bf10-eb038c390688)	Attack Pattern	ObliqueRAT - S0644 (5864e59f-eb4c-43ad-83b2-b5e4fae056c9)	Malware	1
Steganography - T1027.003 (c2e147a9-d1a8-4074-811a-d8789202d916)	Attack Pattern	ObliqueRAT - S0644 (5864e59f-eb4c-43ad-83b2-b5e4fae056c9)	Malware	1
ObliqueRAT - S0644 (5864e59f-eb4c-43ad-83b2-b5e4fae056c9)	Malware	Video Capture - T1125 (6faf650d-bf31-4eb4-802d-1000cf38efaf)	Attack Pattern	1
ObliqueRAT - S0644 (5864e59f-eb4c-43ad-83b2-b5e4fae056c9)	Malware	Data Transfer Size Limits - T1030 (c3888c54-775d-4b2f-b759-75a2ececcbfd)	Attack Pattern	1
ObliqueRAT - S0644 (5864e59f-eb4c-43ad-83b2-b5e4fae056c9)	Malware	Peripheral Device Discovery - T1120 (348f1eef-964b-4eb6-bb53-69b3dcb0c643)	Attack Pattern	1
Process Discovery - T1057 (8f4a33ec-8b1f-4b80-a2f6-642b2e479580)	Attack Pattern	ObliqueRAT - S0644 (5864e59f-eb4c-43ad-83b2-b5e4fae056c9)	Malware	1
ObliqueRAT - S0644 (5864e59f-eb4c-43ad-83b2-b5e4fae056c9)	Malware	System Owner/User Discovery - T1033 (03d7999c-1f4c-42cc-8373-e7690d318104)	Attack Pattern	1
ObliqueRAT - S0644 (5864e59f-eb4c-43ad-83b2-b5e4fae056c9)	Malware	System Checks - T1497.001 (29be378d-262d-4e99-b00d-852d573628e6)	Attack Pattern	1
ObliqueRAT - S0644 (5864e59f-eb4c-43ad-83b2-b5e4fae056c9)	Malware	Malicious Link - T1204.001 (ef67e13e-5598-4adc-bdb2-998225874fa9)	Attack Pattern	1
Local Data Staging - T1074.001 (1c34f7aa-9341-4a48-bfab-af22e51aca6c)	Attack Pattern	Data Staged - T1074 (7dd95ff6-712e-4056-9626-312ea4ab4c5e)	Attack Pattern	2
Registry Run Keys / Startup Folder - T1547.001 (9efb1ea7-c37b-4595-9640-b7680cd84279)	Attack Pattern	Boot or Logon Autostart Execution - T1547 (1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf)	Attack Pattern	2
Steganography - T1027.003 (c2e147a9-d1a8-4074-811a-d8789202d916)	Attack Pattern	Obfuscated Files or Information - T1027 (b3d682b6-98f2-4fb0-aa3b-b4df007ca70a)	Attack Pattern	2
Virtualization/Sandbox Evasion - T1497 (82caa33e-d11a-433a-94ea-9b5a5fbef81d)	Attack Pattern	System Checks - T1497.001 (29be378d-262d-4e99-b00d-852d573628e6)	Attack Pattern	2
User Execution - T1204 (8c32eb4d-805f-4fc5-bf60-c4d476c131b5)	Attack Pattern	Malicious Link - T1204.001 (ef67e13e-5598-4adc-bdb2-998225874fa9)	Attack Pattern	2