Prorat

Overview

ProRAT (historically one of the most famous and widely distributed commercial remote access trojans, written in C++ by Turkish programmers and active since 2003) is a full-featured client-server backdoor targeting Windows systems. ProRAT allows attackers to construct customized server stagers configured to notify operators via ICQ or email upon victim infection. The backdoor server binds a stealth TCP listening port or makes reverse connections to the operator client. ProRAT provides complete administrative control over compromised endpoints: remote desktop viewing, microphone eavesdropping, webcam streaming, keystroke logging, file management (upload, download, execution), registry manipulation, CD tray opening/closing, screen freezing, and password extraction from browsers, email clients, and system dial-up connections. It disables antivirus processes, hides its binary in %SystemRoot%, and installs as a persistent Windows service.

Known aliases

Threat reports may refer to this family under multiple names:

• Backdoor:Win32/ProRAT
• Trojan:Win32/ProRAT
• Backdoor.ProRAT
• Win32/ProRAT
• ProRAT Server
• ProRAT Trojan

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.001: Implement Endpoint Detection and Response (EDR) to monitor for suspicious API calls related to keystroke interception. Enforce Multi-Factor Authentication (MFA) to render stolen passwords useless.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_PRORAT_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Prorat"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "prorat" ascii wide nocase
        $s2 = "backdoor:win32/prorat" ascii wide nocase
        $s3 = "trojan:win32/prorat" ascii wide nocase
        $s4 = "backdoor.prorat" ascii wide nocase
        $s5 = "win32/prorat" ascii wide nocase
        $s6 = "prorat server" ascii wide nocase
        $s7 = "prorat trojan" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Prorat (Rat) Execution & Triage
id: 66591b2b-1931-5e0c-b97e-83ade4e8e399
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Prorat malware family. Detects unauthorized persistence creation via Windows
  Registry Run keys, scheduled tasks, and privilege escalation indicative of RAT installations.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/prorat
- https://malware-families-catalog.systemhelpdesk.com/defensive/backdoor-rat-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.rat
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1059_003
- attack.t1056_001
- attack.t1113
- attack.t1125
- attack.t1543_003
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \reg.exe
    - \schtasks.exe
    - \cmd.exe
    - \powershell.exe
    CommandLine|contains:
    - \CurrentVersion\Run
    - /create /tn
    - bypass -enc
    - net user /add
    - net localgroup administrators
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: high

rule MALWARE_WIN_PRORAT_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Prorat tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "prorat" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate the endpoint from the network; an active adversary is likely controlling the machine and may be viewing the screen.
2. Assume all local credentials, passwords, and sensitive files on the machine have been stolen or compromised.
3. Do not attempt to 'clean' the machine manually; ProRat utilizes aggressive hiding techniques and often drops secondary backdoors.
4. Perform a complete bare-metal rebuild of the operating system after capturing forensic evidence (RAM dump and disk image).

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not engage with the attacker if they initiate a chat session through the RAT; immediately disconnect the network cable.
2. Avoid relying solely on software firewalls to block the connection, as ProRat actively attempts to disable or bypass local security software.

References & External Analysis

• Microsoft Defender Threat Encyclopedia - Backdoor:Win32/ProRAT
• Trend Micro Security Research - BKDR_PRORAT Analysis
• MITRE ATT&CK - Remote Access Software & Backdoors
• Search "prorat" on VirusTotal (External Analysis)
• Search "prorat" on Any.Run (Sandbox Sandbox)
• Search "prorat" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Rat)

Explore other documented threats in the same operational category:

• Netbus
• Plugx
• Hav_Rat
• Darkkomet
• Nanobot
• Zegost
• Rebhip
• Immirat

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/prorat.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.