[Intel]: https://www.group-ib.com/blog/krasue-rat/

[timb-machine]

Area

Malware reports

Parent threat

Persistence, Privilege Escalation, Defense Evasion, Command and Control

Finding

https://www.group-ib.com/blog/krasue-rat/

Industry reference

uses:AbnormalSignal
attack:T1071:Application Layer Protocol
uses:RTSP
attack:T1547.006:Kernel Modules and Extensions
attack:T1564.001:Hidden Files and Directories
attack:T1205:Traffic Signaling

Malware reference

Krasue
Diamorphine
#217
Suterusu
#491
Rooty
#440

Actor reference

No response

Component

Linux

Scenario

No response