{
  "family": "immirat",
  "sample_count": 17,
  "category": "rat",
  "description": "Immirat (classified across cybersecurity vendors as Trojan:Win32/Immirat, Backdoor:Win32/Immirat, and Trojan.Generic.Immirat) is a sophisticated remote access trojan (RAT) and backdoor targeting Microsoft Windows operating systems. Derived from modular commercial surveillance and crimeware frameworks, Immirat provides malicious operators with total interactive remote management over compromised endpoints. Upon execution, the malware establishes persistent registry Run keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and creates disguised background tasks. It initializes an encrypted TCP socket channel with remote command-and-control (C2) servers to receive operator instructions. Immirat is equipped with comprehensive surveillance modules including live remote desktop streaming, microphone and webcam capture, low-level keystroke logging, clipboard interception, and automated credential harvesting from web browsers and email clients. Furthermore, the backdoor supports arbitrary file upload and download, remote process injection into svchost.exe, command shell execution, and the ability to drop secondary ransomware or cryptocurrency mining payloads.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Immirat",
    "Backdoor:Win32/Immirat",
    "Win32/Immirat",
    "ImmiRAT",
    "Trojan.Immirat"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Immirat?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Immirat is a remote access trojan (RAT) and backdoor granting attackers interactive surveillance and full administrative control over infected Windows hosts."
      }
    },
    {
      "@type": "Question",
      "name": "How does Immirat establish command-and-control communication?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It establishes outbound encrypted TCP sockets over non-standard high ports, exchanging encrypted heartbeat beacons and operator commands."
      }
    },
    {
      "@type": "Question",
      "name": "What surveillance capabilities does Immirat possess?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Immirat records keystrokes, steals clipboard contents, captures webcam and audio streams, takes desktop screenshots, and harvests browser passwords."
      }
    },
    {
      "@type": "Question",
      "name": "How is Immirat distributed to victims?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is distributed through spear-phishing emails containing malicious invoice attachments, Trojanized freeware cracks, and pirated software archives."
      }
    },
    {
      "@type": "Question",
      "name": "How do security teams remediate an Immirat infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the host, terminate unauthorized svchost injections, remove autostart registry entries, block C2 IPs at the perimeter, and revoke compromised credentials."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1055",
    "T1056.001",
    "T1113",
    "T1125",
    "T1547.001",
    "T1071.001",
    "T1041"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Credential Access"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Immediately isolate the infected endpoint from the network; an active, human adversary is likely controlling the machine in real-time.",
    "Assume all local credentials and session tokens on the machine have been compromised and initiate enterprise-wide password resets.",
    "Capture a forensic memory image (RAM dump) to extract the decrypted C2 configuration and analyze any active reverse shell connections.",
    "Hunt for lateral movement originating from the infected machine by analyzing Windows Event Logs (e.g., Event ID 4624 for successful network logons)."
  ],
  "what_to_avoid": [
    "Do not simply delete the RAT executable and leave the machine on the network; the attacker may have already established secondary backdoors or compromised other hosts.",
    "Avoid relying solely on static AV scans, as RATs frequently update their payloads and inject into memory to evade file-based detection."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Immirat",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Immirat"
    },
    {
      "name": "Trend Micro Threat Intelligence Encyclopedia - Trojan.Win32.IMMIRAT",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.immirat"
    },
    {
      "name": "MITRE ATT&CK - Remote Access Software & Backdoor Techniques",
      "url": "https://attack.mitre.org/techniques/T1059/003/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}