SombRAT

ATP Sandbox Adv. Heuristics

Stats

First seen: November 2023
Last seen: September 2026

MITRE ATT&CK techniques

24 techniques across 6 tactics.

TA0002 Execution

T1106Native API

TA0005 Stealth

T1027Obfuscated Files or Information
T1036Masquerading
T1055Process Injection
- T1055.001Dynamic-link Library Injection
T1070Indicator Removal
- T1070.004File Deletion
T1140Deobfuscate/Decode Files or Information
T1564Hide Artifacts
- T1564.010Process Argument Spoofing

TA0007 Discovery

T1007System Service Discovery
T1033System Owner/User Discovery
T1057Process Discovery
T1082System Information Discovery
T1083File and Directory Discovery
T1124System Time Discovery

TA0009 Collection

T1005Data from Local System
T1074Data Staged
- T1074.001Local Data Staging
T1560Archive Collected Data
- T1560.003Archive via Custom Method

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.004DNS
T1090Proxy
T1095Non-Application Layer Protocol
T1105Ingress Tool Transfer
T1568Dynamic Resolution
- T1568.002Domain Generation Algorithms
T1573Encrypted Channel
- T1573.002Asymmetric Cryptography
- T1573.001Symmetric Cryptography

TA0010 Exfiltration

T1041Exfiltration Over C2 Channel

Associated campaigns

C0004CostaRicto

Alert name variants

Alert Name	Engine
Win32.Trojan.Sombrat	ATP Sandbox Adv. Heuristics
Win64.Backdoor.Sombrat	ATP Sandbox Adv. Heuristics

Related families

InvisiMole QakBot PlugX Bisonal Cobalt Strike