{
  "name": "The Evolution of Dark Caracal Tools: Campaign Analysis Using the Poco RAT",
  "slug": "the-evolution-of-dark-caracal-tools-campaign-analysis-using-the-poco-rat",
  "description": "Attacks using the Poco RAT are a continuation of the Dark Caracal group's campaign. This campaign was launched in 2022 and is aimed at Spanish-speaking countries in Latin America.",
  "published": "2025-03-05T17:21:14+00:00",
  "created_at": "2025-03-05T17:21:14+00:00",
  "modified_at": "2025-03-05T17:37:18+00:00",
  "created_at_opencti": "2025-03-05T17:21:14+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-03-05",
    "bandook",
    "dark caracal",
    "executables",
    "phishing",
    "poco c++",
    "poco rat",
    "rat",
    "ultimate packer",
    "virtualbox",
    "vmware",
    "windows"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "94.131.119.126"
      },
      {
        "id": "",
        "name": "83.97.20.153"
      },
      {
        "id": "",
        "name": "77.91.100.237"
      },
      {
        "id": "",
        "name": "45.67.34.219"
      },
      {
        "id": "",
        "name": "194.48.248.72"
      },
      {
        "id": "",
        "name": "185.216.68.143"
      },
      {
        "id": "",
        "name": "185.216.68.121"
      },
      {
        "id": "",
        "name": "185.10.68.52"
      },
      {
        "id": "",
        "name": "193.233.203.63"
      },
      {
        "id": "",
        "name": "e5ce11d9bdc7433f713a6f7bd1c05b0a98355ad8a9995e0b5349b10c9d0df1b1"
      },
      {
        "id": "",
        "name": "e5bc162807af900cf73a3f9a3e4cc1c5b10f774f44baa3632f4af6465c80c464"
      },
      {
        "id": "",
        "name": "c8d20ae481f17de8606b92ab3170daea423081bf854d4b6957d7f2dd114a1f6a"
      },
      {
        "id": "",
        "name": "a6ac2fd5dc59f5300c930b3fd5ffd6ed6e4dc27a2707e0293d521c88de027d4b"
      },
      {
        "id": "",
        "name": "918309457c875042e044510966083575a1635e977f1baed76b4f35815d631da1"
      },
      {
        "id": "",
        "name": "8a0beec469a4373a2ebb4b21f013c33e3d2c539514462df5ff88dc8df9e87b3b"
      },
      {
        "id": "",
        "name": "57358c9f7f38a9364884cdcc4919ec3f7c71f147e4329d72867f29f1828aac4e"
      },
      {
        "id": "",
        "name": "44945f3a5be8e627adcc2bf91e971b405a3c3ad22f2b219c99ffb05628895bec"
      },
      {
        "id": "",
        "name": "3fe4ac73a5c94ac392ad43bde078e27b3dcab03717e13e5515ef6fd9a2dea711"
      },
      {
        "id": "",
        "name": "3cc284cecc3a8513d8ba664f88c1164312c049822f9deb009fd0f63dd0c22801"
      },
      {
        "id": "",
        "name": "3c099ec7363407c9fb742beca81f97ecca93807e0f4c7fe73e019a3ccedbd220"
      },
      {
        "id": "",
        "name": "302c707321abc9eca4d14171a33c9c5207711d2a18acc81b31a40bb68d6bea99"
      },
      {
        "id": "",
        "name": "289757c325556561c88a3918f3cc04251dc1d2fe2dbfc24acf8e635da7982853"
      },
      {
        "id": "",
        "name": "26ee4581ec0d064a1296e8178b016249977a483fccb89dd55ab6634aac4faa0f"
      },
      {
        "id": "",
        "name": "247b0725fc0935131537dd00eb454269f3dd5c8c94002448c7b3c27a9aafc75c"
      },
      {
        "id": "",
        "name": "21ff46a6fc9173fcc147d7a5c603032c662c6c1f1b05c1bb1e30e20e168bb056"
      },
      {
        "id": "",
        "name": "1e7d86f9ff5fd50aeeeb04040baad0ac0d84347d60e132458448096a758e9ace"
      },
      {
        "id": "",
        "name": "1cd3fce0b3fa628bf174fdd4151626327eab3aa3ce0f81ecd2423c4b56b221bf"
      },
      {
        "id": "",
        "name": "18ba3612b1f0dbd23f8ab39b2d096bab0ed3438b37932f473c787e24e57e8397"
      },
      {
        "id": "",
        "name": "1786f16a50a4255df8aa32f2e21f2829b4f8aaba2ced3e4a7670846205b3ac70"
      },
      {
        "id": "",
        "name": "158255fa4a257953edf84323b4d7fef129ab55450919a66d6ce8bc9d78612230"
      },
      {
        "id": "",
        "name": "13306775fdf506b706693deccb44ec364fe04dbf3c471227c2439c2462e19080"
      },
      {
        "id": "",
        "name": "12e849ffba407d5db756879fd257c4b736eb4b6adac6320d2f1916d6a923fa46"
      },
      {
        "id": "",
        "name": "121d941ba5a6ff8d99558e0919f49b926fbcd00e3007aad14ac85e799d55473c"
      },
      {
        "id": "",
        "name": "0ffc7ae741bb90c7f8e442d89b985def9969ebf293442f751ab2e69f4df226a8"
      },
      {
        "id": "",
        "name": "0fe11d78990590652f4d0f3afba5670e030b8ab714db9083fd0a981e0f1f48f3"
      },
      {
        "id": "",
        "name": "0d6822c93cb78ad0d2ad34ba9057a6c9de8784f55caa6a8d8af77fed00f0da0a"
      },
      {
        "id": "",
        "name": "0864b87a18356bbe93b2e10f1deee5d4b705fc824899d227ced25c96390b8a0d"
      },
      {
        "id": "",
        "name": "08552f588eafceb0fa3117c99a0059fd06882a36cc162a01575926736d4a80eb"
      },
      {
        "id": "",
        "name": "032ff087debc175342e01a3bb205fbd7ab2e724babcb24cc4b66f1d8df783612"
      },
      {
        "id": "",
        "name": "05bf7db7debfeb56702ef1b421a336d8431c3f7334187d2ccd6ba34816a3fd5a"
      },
      {
        "id": "",
        "name": "01e8536751080ea135c3ad7ae9187d06cdcccddfc89bc0d41ea4281eeb3e9fb4"
      }
    ],
    "malware": [
      {
        "id": "d6f475d8-45f8-4895-bd87-82d1dd7f2b1e",
        "name": "Poco RAT",
        "slug": "poco-rat"
      },
      {
        "id": "9c47393e-80ed-41c0-9134-84db0688dadb",
        "name": "Bandook",
        "slug": "bandook"
      }
    ],
    "intrusion_sets": [
      {
        "id": "42acbef8-9013-41bc-8e51-8889da9172a8",
        "name": "Dark Caracal",
        "slug": "dark-caracal"
      }
    ],
    "attack_patterns": [
      {
        "id": "8e0fea81-4d54-4e88-a7dd-3aa8b26558ed",
        "name": "T1113"
      },
      {
        "id": "fc699aef-8931-4a79-8f79-9651be9abd50",
        "name": "T1021"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "31d29704-da1c-47ea-b93f-76d368813bdf",
        "name": "T1560"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ]
  },
  "external_refs": [
    "https://www.ptsecurity.com/ru-ru/research/pt-esc-threat-intelligence/ehvolyuciya-instrumentov-dark-caracal-analiz-kampanii-s-ispolzovaniem-poco-rat/#id14",
    "https://otx.alienvault.com/pulse/67c8961bf10b4d1579405c67"
  ]
}