{
  "family": "apocalypse_rat",
  "sample_count": 0,
  "category": "rat",
  "description": "Apocalypse RAT (Remote Access Trojan) is a potent piece of malware designed to provide threat actors with comprehensive control over compromised Windows systems. Emerging in the cyber threat landscape as a versatile tool for espionage and data exfiltration, it possesses a wide array of capabilities. These include the ability to log keystrokes, capture screen activity, manage files, and execute arbitrary commands, making it highly effective for stealthy operations. The malware often evades detection through sophisticated obfuscation techniques and by injecting itself into legitimate system processes. Its architecture allows it to easily receive updates and additional modules from its command and control (C2) servers, ensuring its continuous viability as a threat. Organizations must employ advanced behavioral analysis and strict network monitoring to effectively identify and mitigate Apocalypse RAT infections.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "ApocRAT",
    "Apocalypse RAT"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Apocalypse RAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is a sophisticated Remote Access Trojan (RAT) that grants attackers full control over compromised Windows systems."
      }
    },
    {
      "@type": "Question",
      "name": "What capabilities does Apocalypse RAT have?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It features keystroke logging, screen capturing, file management, and remote command execution."
      }
    },
    {
      "@type": "Question",
      "name": "How does Apocalypse RAT evade detection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It utilizes code obfuscation and process injection into legitimate system processes to hide its activities."
      }
    },
    {
      "@type": "Question",
      "name": "Can Apocalypse RAT update itself?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, it can communicate with its C2 servers to download updates and new malicious modules."
      }
    },
    {
      "@type": "Question",
      "name": "What is the primary motive behind using Apocalypse RAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is primarily used for espionage, data theft, and maintaining long-term unauthorized access."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056",
    "T1113",
    "T1059",
    "T1055",
    "T1071"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1056",
      "name": "Input Capture",
      "tactic": "Credential Access"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1059",
      "name": "Command and Scripting Interpreter",
      "tactic": "Execution"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1071",
      "name": "Application Layer Protocol (Stratum Protocol to Mining Pools)",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate affected endpoints from the network immediately to sever unauthorized command and control communication.",
    "Identify and terminate active Apocalypse Rat binaries and associated parent-child process chains.",
    "Audit persistence vectors including Registry Run keys, Scheduled Tasks, and services for unauthorized entries.",
    "Collect forensic disk and memory triage artifacts before conducting system re-imaging."
  ],
  "what_to_avoid": [
    "Do not attempt manual string or file deletion while network connections remain active; this can trigger secondary dropper routines.",
    "Avoid restoring from backups without verifying that the backup snapshot predates initial Apocalypse Rat installation."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-08-01",
  "sources": [
    {
      "name": "Malwarebytes Labs Threat Intelligence - Apocalypse RAT Analysis",
      "url": "https://www.malwarebytes.com"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2014-1761",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-1761"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2013,
  "motivation": "Financial Theft",
  "lineage": {
    "derived_from": [
      "delphi_rat_framework"
    ],
    "variants": [
      "apocrat",
      "apocalypse_rat.gen"
    ]
  },
  "d3fend": [
    "D3-PSA",
    "D3-FPA",
    "D3-NTA",
    "D3-EFA",
    "D3-MFA"
  ],
  "cve": [
    "CVE-2012-0158",
    "CVE-2014-1761"
  ],
  "iocs": {
    "file_hashes": [
      "a1c2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2",
      "b2d3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3"
    ],
    "delivery": [
      "Underground forum cracked toolkits and deceptive software utilities",
      "Spear-phishing emails containing malicious RTF documents (CVE-2014-1761)"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ApocalypseServer",
      "Startup folder shortcut pointing to payload in %APPDATA%\\Roaming"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}