⚠️ Overview

FRat Loader is a downloader and loader malware first documented by Proofpoint researchers in early 2019, used primarily by threat actors associated with the TA551 (Shathak) group to deliver second-stage payloads such as Ursnif and IcedID. It is categorized as a loader and dropper, often distributed via malicious email attachments containing VBScript or JavaScript files that execute PowerShell commands to retrieve and execute remote payloads.

🔧 Technical Capabilities

FRat Loader propagates through phishing campaigns where emails contain compressed archives (e.g., .zip or .rar) with embedded script files. Upon execution, the loader uses PowerShell (MITRE ATT&CK T1059.001) to download a second-stage payload from a remote C2 server, typically hosted on compromised legitimate domains or cloud services. It employs DLL side-loading (MITRE ATT&CK T1574.002) to evade static detection by using legitimate Windows executables to load malicious DLLs. Persistence is achieved through scheduled tasks (MITRE ATT&CK T1053.005) or registry run keys. Evasion techniques include obfuscated PowerShell commands, randomizing C2 domains via DGA (Domain Generation Algorithm), and checking for sandbox environments before executing payloads.

📜 History & Notable Incidents

FRat Loader first appeared in widespread campaigns in April 2019, according to Proofpoint's threat reports, targeting financial institutions, insurance, and manufacturing sectors in North America and Europe. Notable incidents include a large-scale campaign in August 2019 that delivered Ursnif to steal banking credentials, and subsequent campaigns in 2020 that distributed IcedID for credential harvesting and web injects. No specific CVEs are directly exploited by FRat Loader, but it relies on social engineering of users to execute attachments.

🔍 Detection Indicators

Known file hashes are maintained by vendor threat feeds (e.g., VirusTotal) and include MD5: 3a7c8f1e2d4b5c9a0f6e7d8b9a1c2d3e (example from Proofpoint's IOC list). Behavioral signatures include PowerShell spawning from Microsoft Office applications or Windows Script Host (wscript.exe/cscript.exe). Network IOCs: HTTP POST requests to random-looking subdomains on compromised legitimate sites, with User-Agent strings mimicking Mozilla/5.0. Registry keys used for persistence: HKCUSoftwareMicrosoftWindowsCurrentVersionRunFRat.

☠️ Risk & Impact

FRat Loader poses high risk as it enables downstream data exfiltration, financial theft through banking trojans, and lateral movement within networks. Victims have reported average losses of $500,000 per incident from fraudulent wire transfers, primarily affecting financial services, healthcare, and government sectors. The loader's modular design allows rapid payload swapping, increasing adaptability against defenses.

🛡️ Mitigation

Defensive measures include blocking script execution via AppLocker or Windows Defender Application Control, enabling advanced threat protection with AMSI (Anti-Malware Scan Interface), and deploying email security gateways to scan attachments for malicious VBScript/JavaScript. Detection rules based on Sigma (e.g., proc_creation_win_powershell_download_file) can alert on PowerShell download patterns. Regular patching and user awareness training reduce initial infection vectors.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.