{
  "family": "beast",
  "sample_count": 0,
  "category": "rat",
  "description": "Beast is a notorious Remote Access Trojan (RAT) that gained significant popularity in the early 2000s, primarily targeting Windows operating systems (Windows 95 through Windows XP). Written in Delphi, it was known for being one of the first RATs to incorporate an 'injection' method, commonly referred to as reverse connection, which allowed it to bypass basic hardware firewalls and NAT configurations. Beast provided a comprehensive suite of malicious capabilities, including file management, registry editing, webcam capture, and keystroke logging. Its graphical user interface (GUI) was notably user-friendly, which lowered the barrier to entry for novice cybercriminals, often termed 'script kiddies'. The architecture of Beast allowed attackers to compile the server component with various settings, enabling customized deployments that could evade simplistic signature-based detection mechanisms of that era.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Beast RAT",
    "Tataye"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Beast malware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Beast is a widely used Remote Access Trojan from the early 2000s that targeted older Windows systems."
      }
    },
    {
      "@type": "Question",
      "name": "What made Beast unique at the time of its release?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It popularized the reverse connection method, allowing it to bypass many contemporary firewalls."
      }
    },
    {
      "@type": "Question",
      "name": "What language was Beast written in?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The Beast RAT was developed using the Delphi programming language."
      }
    },
    {
      "@type": "Question",
      "name": "What capabilities did Beast provide to attackers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It offered extensive control, including registry editing, file manipulation, and webcam hijacking."
      }
    },
    {
      "@type": "Question",
      "name": "Who typically used the Beast RAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Due to its intuitive interface, it was highly favored by less experienced attackers, or 'script kiddies'."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1090",
    "T1056",
    "T1112",
    "T1125",
    "T1059"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1090",
      "name": "Proxy",
      "tactic": "Command and Control"
    },
    {
      "id": "T1056",
      "name": "Input Capture",
      "tactic": "Credential Access"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1125",
      "name": "Video Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1059",
      "name": "Command and Scripting Interpreter",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Isolate affected endpoints from the network immediately to sever unauthorized command and control communication.",
    "Identify and terminate active Beast binaries and associated parent-child process chains.",
    "Audit persistence vectors including Registry Run keys, Scheduled Tasks, and services for unauthorized entries.",
    "Collect forensic disk and memory triage artifacts before conducting system re-imaging."
  ],
  "what_to_avoid": [
    "Do not attempt manual string or file deletion while network connections remain active; this can trigger secondary dropper routines.",
    "Avoid restoring from backups without verifying that the backup snapshot predates initial Beast installation."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-08-01",
  "sources": [
    {
      "name": "F-Secure Threat Description - Backdoor:W32/Beast",
      "url": "https://www.f-secure.com"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2003-0352",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2003-0352"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2001,
  "motivation": "Financial Theft",
  "lineage": {
    "derived_from": [
      "delphi_reverse_rat_engine"
    ],
    "variants": [
      "beast_2.06",
      "beast_2.07",
      "tataye_rat"
    ]
  },
  "d3fend": [
    "D3-PSA",
    "D3-FPA",
    "D3-NTA",
    "D3-EFA",
    "D3-MFA"
  ],
  "cve": [
    "CVE-2003-0352",
    "CVE-2003-0533"
  ],
  "iocs": {
    "file_hashes": [
      "07c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8",
      "18d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9"
    ],
    "delivery": [
      "Social engineering file transfers via instant messaging and IRC networks",
      "Direct endpoint compromise exploiting Windows DCOM RPC buffer overflows (CVE-2003-0352)"
    ],
    "persistence": [
      "DLL injection into winlogon.exe and explorer.exe memory spaces",
      "HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit modification"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}