{
  "family": "buterat",
  "sample_count": 77,
  "category": "backdoor",
  "description": "ButeRAT (cataloged in threat research and security telemetry under signatures including Backdoor:Win32/ButeRAT, Backdoor.Win32.Buterat, and Trojan:Win32/ButeRAT) is a stealthy remote access trojan and cyber espionage backdoor active since 2014. Designed for long-term intelligence gathering and covert reconnaissance against enterprise and government targets, ButeRAT employs advanced execution hijacking techniques—utilizing low-level Windows APIs such as SetThreadContext and ResumeThread to manipulate thread contexts and inject code into legitimate host processes without triggering child process creation heuristics. Once resident, ButeRAT drops auxiliary persistence binaries disguised with names mimicking legitimate Windows background services (such as amhost.exe or bmhost.exe) in hidden user directories. ButeRAT establishes encrypted C2 communications to receive operator instructions, enabling remote command execution, keystroke capture, sensitive file exfiltration, and secondary payload deployment.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/ButeRAT",
    "Backdoor.Win32.Buterat",
    "Trojan:Win32/ButeRAT"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Backdoor:Win32/ButeRAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "ButeRAT is a sophisticated remote access trojan and espionage backdoor designed for persistent enterprise surveillance."
      }
    },
    {
      "@type": "Question",
      "name": "How does ButeRAT evade process-based endpoint detection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses SetThreadContext and ResumeThread to hijack execution inside legitimate running processes."
      }
    },
    {
      "@type": "Question",
      "name": "Which filenames are commonly used by ButeRAT persistence components?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It frequently disguises dropped helper binaries under names like amhost.exe or bmhost.exe."
      }
    },
    {
      "@type": "Question",
      "name": "How does ButeRAT infiltrate target networks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through targeted spearphishing emails with weaponized attachments and deceptive software downloads."
      }
    },
    {
      "@type": "Question",
      "name": "What remediation steps should be taken following a ButeRAT alert?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the endpoint immediately, inspect startup directories for amhost.exe, run an EDR sweep, and rotate network credentials."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.001",
    "T1055.001",
    "T1059.003",
    "T1547.001",
    "T1056.001",
    "T1113",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to sever the attacker's interactive, remote-control session.",
    "Capture a full forensic memory image of the machine to extract the decrypted Buterat payload and its C2 configuration.",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Buterat persistence mechanisms.",
    "Assume total endpoint compromise; perform a clean OS rebuild and force password resets for all accounts that accessed the machine."
  ],
  "what_to_avoid": [
    "Do not leave the machine connected to the network during triage; the attacker has live access and will likely destroy evidence or move laterally.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Targeted Cyber Espionage",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2014,
  "threat_actor": null,
  "delivery_mechanism": [
    "Spearphishing Email Attachments",
    "Weaponized Office Documents",
    "Trojanized Software Installers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Thread Context Hijacking",
    "Remote Command Execution",
    "Keystroke Logging",
    "File Exfiltration",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Obfuscated TCP traffic to remote C2 IP addresses",
      "Encrypted configuration exchange upon initial check-in"
    ],
    "evasion_techniques": [
      "SetThreadContext API injection avoiding new process creation",
      "Service name masquerading (amhost.exe, bmhost.exe)"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ButeRAT",
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\amhost"
    ]
  },
  "impact": {
    "confidentiality": "High",
    "integrity": "High",
    "availability": "Medium",
    "scope": "Long-term espionage, confidential document exfiltration, unauthorized remote administration"
  },
  "lineage": {
    "derived_from": [
      "Custom Cyber Espionage RATs"
    ],
    "variants": [
      "ButeRAT.A",
      "ButeRAT.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e",
      "0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f"
    ],
    "delivery": [
      "document_review.exe",
      "amhost.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\AMHostClient",
      "%AppData%\\ButeRAT\\bmhost.exe"
    ]
  },
  "sources": [
    {
      "name": "Broadcom Symantec Security - Backdoor.Buterat Threat Report",
      "url": "https://www.broadcom.com/support/security-center"
    },
    {
      "name": "Microsoft Defender Security Intelligence - Backdoor:Win32/ButeRAT",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/ButeRAT"
    }
  ]
}