ThaiCERT    ETDA    MDES
Report
Search
Home > List all groups > List all tools > List all groups using tool Ratankba

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Tool: Ratankba

NamesRatankba
Ratabanka
QUICKRIDE
CategoryMalware
TypeBackdoor, Info stealer
Description(Trend Micro) During our analysis, we collected a copy of the RATANKBA malware’s Lazarus Remote Controller tool. The remote controller provides a user interface that allows attackers to send jobs to any compromised endpoint. The controller gives the attackers the ability to manipulate the victims’ host by queueing tasks on the main server. RATANKBA retrieves and executes the tasks, and retrieves the collected information.
Information<https://blog.trendmicro.com/trendlabs-security-intelligence/lazarus-campaign-targeting-cryptocurrencies-reveals-remote-controller-tool-evolved-ratankba/>
MITRE ATT&CK<https://attack.mitre.org/software/S0241/>
Malpedia<https://malpedia.caad.fkie.fraunhofer.de/details/win.ratabanka>
AlienVault OTX<https://otx.alienvault.com/browse/pulses?q=tag:ratankba>

Last change to this tool card: 22 April 2020

Download this tool card in JSON format

Previous: RARSTONE
Next: RatankbaPOS

All groups using tool Ratankba

ChangedNameCountryObserved

APT groups

 Lazarus Group, Hidden Cobra, Labyrinth ChollimaNorth Korea2007-Spring 2021X

1 group listed (1 APT, 0 other, 0 unknown)

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
E-mail report@thaicert.or.th
PGP Download PGP key