Domain	ID	Name	Use
Enterprise	T1059	Command-Line Interface	NavRAT leverages cmd.exe to perform discovery techniques.^[1]
Enterprise	T1074	Data Staged	NavRAT writes multiple outputs to a TMP file using the >> method.^[1]
Enterprise	T1056	Input Capture	NavRAT logs the keystrokes on the targeted system.^[1]
Enterprise	T1057	Process Discovery	NavRAT uses `tasklist /v` to check running processes.^[1]
Enterprise	T1055	Process Injection	NavRAT copies itself into a running Internet Explorer process to evade detection.^[1]
Enterprise	T1060	Registry Run Keys / Startup Folder	NavRAT creates a Registry key to ensure a file gets executed upon reboot in order to establish persistence.^[1]
Enterprise	T1105	Remote File Copy	NavRAT can download files remotely.^[1]
Enterprise	T1064	Scripting	NavRAT loads malicious shellcode and executes it in memory.^[1]
Enterprise	T1071	Standard Application Layer Protocol	NavRAT uses the email platform, Naver, for C2 communications, leveraging SMTP.^[1]
Enterprise	T1082	System Information Discovery	NavRAT uses `systeminfo` on a victim’s machine.^[1]

Groups

Groups that use this software:

APT37

References