ID	X0021
Type	Remote Access Trojan
Aliases	None
Platforms	Windows
Year	2013
Associated ATT&CK Software	None

Terminator

Terminator is a remote access tool (RAT).

ATT&CK Techniques

Name	Use
Defense Evasion::Virtualization/Sandbox Evasion::User Activity Based Checks (T1497)	The Terminator RAT evades sandboxes by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [2]

Enhanced ATT&CK Techniques

Name	Use
Defense Evasion::Self Deletion (F0007.001)	The RAT evades sandboxes by terminating and removing itself (DW20.exe) after installation. [2]
Persistence::Registry Run Keys / Startup Folder (F0012)	The RAT sets "2019" as a Windows' startup folder by modifying a registry value. [1]
Execution::User Execution (E1204)	The malware relies on user interaction to execute. [2]

MBC Behaviors

Name	Use
Command and Control::C2 Communication::Send Data (B0030.001)	The malware sends data to the C2. [2]
Anti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed Execution (B0003.003)	The Terminator RAT evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [1]
Anti-Behavioral Analysis::Sandbox Detection (B0007)	The Terminator RAT evades a sandbox by not executing until after a reboot. Most sandboxes don't reboot during an analysis. [1]

Indicators of Compromise

SHA256 Hashes

• 1f97d32674964528db46021a0466138dd01458bfa79f7450e2b222ae1de8ac1f

References

[1] https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/pf/file/fireeye-hot-knives-through-butter.pdf

[2] https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2013/FireEye-Terminator_RAT.pdf