[Intel]: https://sansec.io/research/nginrat

[timb-machine]

Area

Malware reports

Parent threat

Defense Evasion

Finding

https://sansec.io/research/nginrat

Industry reference

uses:Non-persistentStorage
attack:T1036.005:Match Legitimate Name or Location
attack:T1574.006:Dynamic Linker Hijacking
attack:T1027:Obfuscated Files or Information
uses:ProcessTreeSpoofing

Malware reference

NginRAT
wltm

Actor reference

No response

Component

No response

Scenario

No response