Skip to content

Woody RAT

Software · ATTACK:enterprise:S1065

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S1065",
  "title": "Woody RAT",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S1065",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--3bc7e862-5610-4c02-9c48-15b2e2dc1ddb",
  "external_id": "S1065",
  "domain": "enterprise",
  "created": "2023-02-14T16:52:39.925Z",
  "modified": "2025-10-21T03:29:54.769Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "MalwareBytes WoodyRAT Aug 2022",
      "url": "https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"
    }
  ]
}

Explicit source assertions (30)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06ab6825-89f4-4bb7-8c82-ae9a5d4cdf61

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--147cd553-fd25-46ea-83ed-594cdb82c440

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c0acd9f-d536-47ec-9473-5d2a5e5dde73

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1fdf1686-f498-460a-8948-a5ca46f52b62

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--303ff42e-09fa-49ab-9fa3-420aedb090dc

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--31728aa8-de3d-4edd-8c39-3d9d3091341a

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--344bbf55-0316-49d0-a5ab-c5f79d218908

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--368510dc-1050-45df-81f2-1fca6118c2b0

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--374d1cee-7c9c-4b3b-8e75-8a5c4caf9d47

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1680

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c8805ff-7345-4763-9757-6a30acfe652c

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1518.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d2cc737-7cbc-476f-afbe-a8fafa7043fe

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1087

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--642039f8-984e-432d-a6a3-bc6b4469bba0

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--71bc9a2e-4536-4b84-9997-126cc4c065bf

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--85fda77f-5129-4de7-bc44-f81ccc46f6d9

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--883822b2-c788-4a60-b9ad-e73e363b1ea6

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88e52860-d4cc-485a-b23f-ad2cda301727

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8989ead1-c778-4645-8d95-2d42d875788b

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b714bbe-2a8e-4673-b840-ca5e93a57b1d

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--90e6cb2a-55c4-4533-bbdc-b8eed2132344

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e47155f-7b98-4fc5-84b3-01bd70418b8e

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e92ab98-b547-4206-8158-a186f7570550

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1016.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a06f76b9-1920-4660-a2f3-cc0db8d585c0

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a6d53c2b-a2d2-4ad6-a61b-b8c88927d66a

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b2191a9b-4963-4fc1-8056-75908795a1af

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b883f2f6-cb3d-4f49-ab42-1fe0b9362ff4

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c9e36653-29fe-4430-b022-cbc855a85f9d

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dac35c07-4a4a-4924-a702-09e5cf988349

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e611b2ca-ecb4-47f4-acc2-614d37926d5b

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1518

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f372cb23-0736-4cbb-8ba0-3388599226f9

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fa50bbff-2f2f-47a8-b295-588e61b76a77

MalwareBytes WoodyRAT Aug 2022

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.