{
	"id": "f261fbde-81bd-45cb-9f7c-e90e5c7572dd",
	"created_at": "2026-04-06T00:16:36.870212Z",
	"updated_at": "2026-04-10T03:26:30.295652Z",
	"deleted_at": null,
	"sha1_hash": "2ecedc9566fc48b883462b67feb6664e301ae2ef",
	"title": "888 RAT - Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 47432,
	"plain_text": "888 RAT - Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-02 11:03:11 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool 888 RAT\n Tool: 888 RAT\nNames 888 RAT\nCategory Tools\nType Backdoor\nDescription\n888 RAT Pro Features :\n• Native Server\n• Work Win ( 7–8–8.1–10 -xp -Vista — 2000–98–95) 64 and 32 Bit\n• Persistence startUp (even if it deleted)\n• sleep\n• hide process (32bit)\n• USB spread shortCut New method\n• Upx\n• spoof any Extention (SCR)\n• Disable teskmgr \u0026 Msconfig\n• Av Obfuscator Usg server Fud\n• Uac Exploit 0 day disable \u0026 enable\n• Bypass AV scanne \u0026 Runtime with Unique Stub Generator (USG)\n• Startup Scheduled\n• Hide installation\n• 2 Costom Builder\n• Icone changer\n• Bind any kind of file\nInformation\nMalpedia Last change to this tool card: 28 December 2021\nDownload this tool card in JSON format\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=8b2de120-e49b-480a-bbbc-9b81b2c470c9\nPage 1 of 2\n\nAll groups using tool 888 RAT\r\nChanged Name Country Observed\r\nAPT groups\r\n  RevengeHotels [Unknown] 2015  \r\n1 group listed (1 APT, 0 other, 0 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=8b2de120-e49b-480a-bbbc-9b81b2c470c9\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=8b2de120-e49b-480a-bbbc-9b81b2c470c9\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=8b2de120-e49b-480a-bbbc-9b81b2c470c9"
	],
	"report_names": [
		"listgroups.cgi?u=8b2de120-e49b-480a-bbbc-9b81b2c470c9"
	],
	"threat_actors": [
		{
			"id": "bfae615f-cb9c-479c-b97d-ba282c322db3",
			"created_at": "2022-10-25T16:07:24.123308Z",
			"updated_at": "2026-04-10T02:00:04.874176Z",
			"deleted_at": null,
			"main_name": "RevengeHotels",
			"aliases": [],
			"source_name": "ETDA:RevengeHotels",
			"tools": [
				"888 RAT",
				"Atros2.CKPN",
				"Bladabindi",
				"Jorik",
				"Nancrat",
				"NanoCore",
				"NanoCore RAT",
				"Revenge RAT",
				"RevengeRAT",
				"Revetrat",
				"Zurten",
				"njRAT"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "31a4f4ad-1aa7-48c2-8b16-58d48879644c",
			"created_at": "2024-02-06T02:00:04.13577Z",
			"updated_at": "2026-04-10T02:00:03.576453Z",
			"deleted_at": null,
			"main_name": "RevengeHotels",
			"aliases": [],
			"source_name": "MISPGALAXY:RevengeHotels",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434596,
	"ts_updated_at": 1775791590,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/2ecedc9566fc48b883462b67feb6664e301ae2ef.pdf",
		"text": "https://archive.orkl.eu/2ecedc9566fc48b883462b67feb6664e301ae2ef.txt",
		"img": "https://archive.orkl.eu/2ecedc9566fc48b883462b67feb6664e301ae2ef.jpg"
	}
}