CARROTBAT — Malware Profile

CARROTBAT is a customized dropper that has been in use since at least 2017. CARROTBAT has been used to install SYSCON and has infrastructure overlap with KONNI.

MITRE ATT&CK techniques (6)

• T1027.010 Command Obfuscation
• T1027.013 Encrypted/Encoded File
• T1059.003 Windows Command Shell
• T1070.004 File Deletion
• T1082 System Information Discovery
• T1105 Ingress Tool Transfer

Read the full analysis on IntelFusions