TF-MAL-js.sqlrat

Description

ThreatFox malware family `js.sqlrat`. Printable name: SQLRat.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• SQLRAT - Threat Group Cards: A Threat Actor Encyclopedia
  web:apt.etda.or.th

  Last change to this tool card: 23 April 2020 Download this tool card in JSON format All groups using tool SQLRAT

  2026-05-22 05:27 UTC
• SQLRat, Software S0390 | MITRE ATT&CK®
  web:attack.cloudfall.cn

  SQLRat is malware that executes SQL scripts to avoid leaving traditional host artifacts. FIN7 has been observed using it. [1] ID: S0390 ⓘ Type: MALWARE Version: 1.1 Created: 18 June 2019 Last Modified: 30 March 2020 ATT&CK® Navigator Layers Techniques Used Domain ID Name Use Enterprise T1059 .001 Command and Scripting Interpreter: PowerShell

  2026-05-22 05:27 UTC
• SQLRat, Software S0390 | MITRE ATT&CK®
  web:attack.mitre.org

  SQLRat SQLRat is malware that executes SQL scripts to avoid leaving traditional host artifacts. FIN7 has been observed using it. [1]

  2026-05-22 05:27 UTC
• SQLRat (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  After deobfuscating the file, the main JavaScript is easily recognizable. It contains a number of functions designed to drop files and execute scripts on a host system. The SQLRat script is designed to make a direct SQL connection to a Microsoft database controlled by the attackers and execute the contents of various tables.

  2026-05-22 05:27 UTC
• Sqlrat analysis - 0xf0x.com - Malware, Threat Hunting & Incident Response
  web:neil-fox.github.io

  Sqlrat analysis SQLrat is a clever piece of malware which is dropped onto the compromised machine using a malicious Word Document. The document contains macros written in Visual Basic which drop a number of files to disk which run malicious code and will also create scheduled tasks so the malware can persist on disk.

  2026-05-22 05:27 UTC
• Y-Security performs Attack Simulations, Penetration Tests, and Security ...
  web:redteam.y-security.de

  SQLRat is malware that executes SQL scripts to avoid leaving traditional host artifacts. FIN7 has been observed using it. 1

  2026-05-22 05:27 UTC
• Is en.readbeast.blog Safe? Security Scan Report | PCrisk
  web:scanner.pcrisk.com

  Is en.readbeast.blog safe to visit? Check our automated security scan: trust score 93/100, 0/91 engines flagged, SSL status, blacklist check. Report generated May 21, 2026. Results are for informational purposes only.

  2026-05-22 05:27 UTC
• FIN7 is back with a previously unseen SQLRat malware
  web:securityaffairs.com

  The financially-motivated hacking group FIN7 is back and used a new piece of malware in a recent hacking campaign.

  2026-05-22 05:27 UTC
• Technical Approaches to Uncovering and Remediating Malicious ... - CISA
  web:www.cisa.gov

  It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.

  2026-05-22 05:27 UTC
• Behavior:Win32/SqlRat.A threat description - microsoft.com
  web:www.microsoft.com

  Understand how this virus or malware spreads and how its payloads affects your computer. Protect against this threat, identify symptoms, and clean up or remove infections.

  2026-05-22 05:27 UTC

Only Available for Registered Users. Sign in to view.