P8RAT - S0626 (7c58fff0-d206-4db1-96b1-e3a9e0e320b9)

P8RAT is a fileless malware used by menuPass to download and execute payloads since at least 2020.(Citation: Securelist APT10 March 2021)

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Junk Data - T1001.001 (f7c0689c-4dbd-489b-81be-7cb7c7079ade)	Attack Pattern	P8RAT - S0626 (7c58fff0-d206-4db1-96b1-e3a9e0e320b9)	Malware	1
Ingress Tool Transfer - T1105 (e6919abc-99f9-4c6c-95a5-14761e7b2add)	Attack Pattern	P8RAT - S0626 (7c58fff0-d206-4db1-96b1-e3a9e0e320b9)	Malware	1
Time Based Evasion - T1497.003 (4bed873f-0b7d-41d4-b93a-b6905d1f90b0)	Attack Pattern	P8RAT - S0626 (7c58fff0-d206-4db1-96b1-e3a9e0e320b9)	Malware	1
Process Discovery - T1057 (8f4a33ec-8b1f-4b80-a2f6-642b2e479580)	Attack Pattern	P8RAT - S0626 (7c58fff0-d206-4db1-96b1-e3a9e0e320b9)	Malware	1
System Checks - T1497.001 (29be378d-262d-4e99-b00d-852d573628e6)	Attack Pattern	P8RAT - S0626 (7c58fff0-d206-4db1-96b1-e3a9e0e320b9)	Malware	1
Junk Data - T1001.001 (f7c0689c-4dbd-489b-81be-7cb7c7079ade)	Attack Pattern	Data Obfuscation - T1001 (ad255bfe-a9e6-4b52-a258-8d3462abe842)	Attack Pattern	2
Time Based Evasion - T1497.003 (4bed873f-0b7d-41d4-b93a-b6905d1f90b0)	Attack Pattern	Virtualization/Sandbox Evasion - T1497 (82caa33e-d11a-433a-94ea-9b5a5fbef81d)	Attack Pattern	2
Virtualization/Sandbox Evasion - T1497 (82caa33e-d11a-433a-94ea-9b5a5fbef81d)	Attack Pattern	System Checks - T1497.001 (29be378d-262d-4e99-b00d-852d573628e6)	Attack Pattern	2