CrossRAT is a cross platform RAT.
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1547 | .001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
CrossRAT uses run keys for persistence on Windows |
| Enterprise | T1543 | .001 | Create or Modify System Process: Launch Agent | |
| Enterprise | T1083 | File and Directory Discovery |
CrossRAT can list all files on a system. |
|
| Enterprise | T1113 | Screen Capture | ||
| ID | Name | References |
|---|---|---|
| G0070 | Dark Caracal |