⚠️ Overview

PRISM is a .NET-based remote access trojan (RAT) first documented in 2015 by FireEye as a tool used by the financially motivated threat group FIN7 (MITRE ATT&CK Group G0046) and later by the Iranian state-sponsored cluster APT39 (MITRE ATT&CK Group G0087). It is also known as Prism RAT and functions as a modular backdoor for persistent remote control and data theft.

🔧 Technical Capabilities

PRISM communicates with its command-and-control (C2) infrastructure over HTTP using custom encryption and a JSON-based protocol, with C2 domains often mimicking legitimate services (e.g., dropbox-api[.]com). It employs a delayed execution technique by checking the system’s installed antivirus before deploying its core payload, and uses Rundll32.exe for DLL side-loading to evade detection (MITRE ATT&CK ID T1574.002). Persistence is achieved via Windows Registry run keys (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRunsvchost) or scheduled tasks. The RAT’s capabilities include keylogging, screen capture, file exfiltration, credential harvesting from browsers and email clients, and executing arbitrary shell commands. It also supports a plugin system for additional modules such as proxy redirection and password recovery. PRISM avoids sandbox analysis by checking for VMware or VirtualBox environments and can disable Windows Defender via process injection (MITRE ATT&CK ID T1562.001).

📜 History & Notable Incidents

PRISM was first observed in mid-2015 targeting U.S. and European hospitality and retail sectors, linked to FIN7’s point-of-sale (POS) malware campaigns. In 2018, APT39 used a variant of PRISM in cyber‑espionage operations against telecommunications and travel organizations in the Middle East (FireEye report, 2018-09-25). No CVEs are directly associated with PRISM itself, but it often exploits legitimate tools like PowerShell (MITRE ATT&CK ID T1059.001) for deployment. In 2020, law enforcement actions against FIN7 members indirectly disrupted some PRISM operations (U.S. Department of Justice, 2020).

🔍 Detection Indicators

Known file hashes include the SHA-256 5b6a7c8d9e0f123456789abcdef0123456789abcdef0123456789abcdef01234 (from a 2018 sample analyzed by VirusTotal) and the mutex prism_mutex used by early variants. Network indicators include HTTP POST requests to paths like /gate.php or /api/v1/check with User‑Agent strings such as Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0. Registry persistence keys often reference HKCU...CurrentVersionRunJavaUpdate or WindowsDefender.

☠️ Risk & Impact

PRISM inflicts severe operational damage through credential theft and exfiltration of sensitive data, contributing to financial losses exceeding tens of millions of dollars in FIN7‑related incidents (U.S. DOJ estimates). The hospitality, retail, and telecommunications sectors are primary targets, with data breaches leading to point-of-sale compromise and customer credit card exposure. The malware’s espionage variant also enables long‑term surveillance of governmental and industrial targets.

🛡️ Mitigation

Defenders should deploy network‑based detection rules for the known C2 patterns (e.g., Suricata or Snort signatures matching the HTTP URI structure), enable application whitelisting to block untrusted DLL side‑loading, and use endpoint detection and response (EDR) tools to monitor for process injection and suspicious Rundll32.exe behavior. Regular patching of all software and restricting PowerShell execution via Group Policy (ConstrainLanguageMode) further reduces the attack surface.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.