{
  "family": "prorat",
  "sample_count": 14,
  "category": "rat",
  "description": "ProRAT (historically one of the most famous and widely distributed commercial remote access trojans, written in C++ by Turkish programmers and active since 2003) is a full-featured client-server backdoor targeting Windows systems. ProRAT allows attackers to construct customized server stagers configured to notify operators via ICQ or email upon victim infection. The backdoor server binds a stealth TCP listening port or makes reverse connections to the operator client. ProRAT provides complete administrative control over compromised endpoints: remote desktop viewing, microphone eavesdropping, webcam streaming, keystroke logging, file management (upload, download, execution), registry manipulation, CD tray opening/closing, screen freezing, and password extraction from browsers, email clients, and system dial-up connections. It disables antivirus processes, hides its binary in %SystemRoot%, and installs as a persistent Windows service.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/ProRAT",
    "Trojan:Win32/ProRAT",
    "Backdoor.ProRAT",
    "Win32/ProRAT",
    "ProRAT Server",
    "ProRAT Trojan"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Backdoor:Win32/ProRAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "ProRAT is a historic remote access trojan (RAT) that grants attackers full remote surveillance and administrative control over Windows PCs."
      }
    },
    {
      "@type": "Question",
      "name": "How does the ProRAT server communicate with attackers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It binds a listening TCP port (such as 5110) or uses reverse connections, notifying operators via automated email or chat alerts."
      }
    },
    {
      "@type": "Question",
      "name": "What surveillance features are included in ProRAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Keystroke logging, screen capture, webcam streaming, audio recording, and browser password extraction."
      }
    },
    {
      "@type": "Question",
      "name": "How does ProRAT survive system restarts?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It installs as a Windows background service or adds autostart values to Windows Run registry keys."
      }
    },
    {
      "@type": "Question",
      "name": "How is ProRAT detected and removed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Scan the system with modern antimalware tools to remove the server executable, delete its service entry, and reset passwords."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1056.001",
    "T1113",
    "T1125",
    "T1543.003",
    "T1547.001",
    "T1071.001",
    "T1041"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Credential Access"
    },
    {
      "id": "T1090",
      "name": "Connection Proxy (Listening Port)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1491",
      "name": "Defacement (UI Manipulation/Joke Payloads)",
      "tactic": "Impact"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network; an active adversary is likely controlling the machine and may be viewing the screen.",
    "Assume all local credentials, passwords, and sensitive files on the machine have been stolen or compromised.",
    "Do not attempt to 'clean' the machine manually; ProRat utilizes aggressive hiding techniques and often drops secondary backdoors.",
    "Perform a complete bare-metal rebuild of the operating system after capturing forensic evidence (RAM dump and disk image)."
  ],
  "what_to_avoid": [
    "Do not engage with the attacker if they initiate a chat session through the RAT; immediately disconnect the network cable.",
    "Avoid relying solely on software firewalls to block the connection, as ProRat actively attempts to disable or bypass local security software."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Backdoor:Win32/ProRAT",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/ProRAT"
    },
    {
      "name": "Trend Micro Security Research - BKDR_PRORAT Analysis",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/bkdr_prorat"
    },
    {
      "name": "MITRE ATT&CK - Remote Access Software & Backdoors",
      "url": "https://attack.mitre.org/techniques/T1059/003/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}