MagicRAT (Malware Family)

MagicRAT

Actor(s): Lazarus Group, Silent Chollima

VTCollection

According to Talos, MagicRAT is programmed in C++ programming language and uses the Qt Framework by statically linking it to the RAT on 32- and 64-bit versions. The Qt Framework is a programming library for developing graphical user interfaces, of which this RAT has none. Talos thinks that the objective was to increase the complexity of the code, thus making human analysis harder. On the other hand, since there are very few examples (if any) of malware programmed with Qt Framework, this also makes machine learning and heuristic analysis detection less reliable. The RAT uses the Qt classes throughout its entire code. The configuration is dynamically stored in a QSettings class eventually being saved to disk, a typical functionality provided by that class.

MagicRAT provides the operator with a remote shell on the victim's system for arbitrary command execution, along with the ability to rename, move and delete files on the endpoint. The operator can determine the timing for the implant to sleep, change the C2 URLs and delete the implant from the infected system.

References

2023-05-25 ⋅ YouTube (BSidesCharm) ⋅ Asheer Malhotra
it’s all Magic(RAT) – A look into recent North Korean nation-state attacks
MagicRAT VSingle YamaBot

2023-02-09 ⋅ CISA, DSA, FBI, HHS, NSA, ROK
#StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities
Dtrack MagicRAT Maui Ransomware SiennaBlue SiennaPurple Tiger RAT YamaBot

2023-01-05 ⋅ AttackIQ ⋅ Francis Guibernau, Ken Towne
Emulating the Highly Sophisticated North Korean Adversary Lazarus Group
MagicRAT Tiger RAT

2022-09-08 ⋅ Cisco Talos ⋅ Asheer Malhotra, Jung soo An, Vitor Ventura
Lazarus and the tale of three RATs
MagicRAT MimiKatz VSingle YamaBot

2022-09-07 ⋅ Cisco Talos ⋅ Asheer Malhotra, Jung soo An, Vitor Ventura
MagicRAT: Lazarus’ latest gateway into victim networks
MagicRAT Tiger RAT

Yara Rules

[TLP:WHITE] win_magic_rat_auto (20260917 | Detects win.magic_rat.)

rule win_magic_rat_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.magic_rat."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.magic_rat"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8b10 85d2 740b 83faff 740f f0832801 7509 }
            // n = 7, score = 600
            //   8b10                 | mov                 edx, dword ptr [eax]
            //   85d2                 | test                edx, edx
            //   740b                 | je                  0xca4
            //   83faff               | cmp                 edx, -1
            //   740f                 | je                  0xbe1
            //   f0832801             | lock sub            dword ptr [eax], 1
            //   7509                 | mov                 eax, dword ptr [esp + 0x28]

        $sequence_1 = { 8b10 85d2 0f84ba010000 83faff }
            // n = 4, score = 600
            //   8b10                 | mov                 dword ptr [esp + 0xc], ecx
            //   85d2                 | mov                 dword ptr [esp + 8], esi
            //   0f84ba010000         | mov                 esi, dword ptr [ebp - 0x148]
            //   83faff               | mov                 dword ptr [esp + 4], esi

        $sequence_2 = { 8b10 85d2 0f8444020000 83faff }
            // n = 4, score = 600
            //   8b10                 | mov                 dword ptr [esp + 4], esi
            //   85d2                 | sub                 esp, 8
            //   0f8444020000         | mov                 dword ptr [esp + 8], eax
            //   83faff               | mov                 dword ptr [esp + 4], esi

        $sequence_3 = { 89c1 83c901 83e201 0f45c1 89c2 }
            // n = 5, score = 600
            //   89c1                 | add                 eax, 1
            //   83c901               | cmp                 eax, 1
            //   83e201               | ja                  0xa70
            //   0f45c1               | mov                 dword ptr [eax], edx
            //   89c2                 | mov                 eax, dword ptr [edx]

        $sequence_4 = { 3d09020000 741f 3d0c020000 7418 eb22 3d0c040000 }
            // n = 6, score = 600
            //   3d09020000           | or                  dword ptr [ebx + 0xc], 2
            //   741f                 | dec                 eax
            //   3d0c020000           | lea                 eax, [0x728e1]
            //   7418                 | dec                 eax
            //   eb22                 | mov                 dword ptr [esp + 0x88], eax
            //   3d0c040000           | dec                 eax

        $sequence_5 = { f20f5c0d???????? 660f2ecc 7308 660f570d???????? f20f102d???????? 660f2ee9 7310 }
            // n = 7, score = 600
            //   f20f5c0d????????     |                     
            //   660f2ecc             | lea                 edi, [ebx + 0x40]
            //   7308                 | mov                 eax, dword ptr [edx]
            //   660f570d????????     |                     
            //   f20f102d????????     |                     
            //   660f2ee9             | cmp                 eax, 1
            //   7310                 | jbe                 0x18a2

        $sequence_6 = { 7448 83f8ff 7406 f0832901 743d }
            // n = 5, score = 600
            //   7448                 | sub                 esp, 0x30
            //   83f8ff               | mov                 esi, dword ptr [esp + 0x44]
            //   7406                 | mov                 ebx, dword ptr [esp + 0x40]
            //   f0832901             | test                esi, esi
            //   743d                 | push                ebx

        $sequence_7 = { 660fefe4 f20f2ae1 f20f5cdc f20f1025???????? }
            // n = 4, score = 600
            //   660fefe4             | dec                 eax
            //   f20f2ae1             | and                 edi, eax
            //   f20f5cdc             | dec                 eax
            //   f20f1025????????     |                     

        $sequence_8 = { 85c0 0f84c9000000 83f8ff 740a f0832a01 }
            // n = 5, score = 600
            //   85c0                 | shr                 edx, 8
            //   0f84c9000000         | lea                 ecx, [edx + ecx + 0x800080]
            //   83f8ff               | mov                 edx, dword ptr [esp + 0x24]
            //   740a                 | and                 ecx, 0xff00ff00
            //   f0832a01             | lea                 ecx, [edx + ecx + 0x800080]

        $sequence_9 = { 89d0 c1e810 0fb6c0 8d1c80 8d1c58 0fb6c6 }
            // n = 6, score = 600
            //   89d0                 | mov                 dword ptr [esp], eax
            //   c1e810               | mov                 dword ptr [esp + 0x20], esi
            //   0fb6c0               | mov                 dword ptr [esp + 0x28], edx
            //   8d1c80               | mov                 dword ptr [esp + 0x24], ecx
            //   8d1c58               | mov                 ecx, ebx
            //   0fb6c6               | mov                 dword ptr [esp], eax

    condition:
        7 of them and filesize < 41843712
}

Download all Yara Rules

MagicRAT Propose Change

References

Yara Rules

MagicRAT