RAT
MagicRAT
According to Talos, MagicRAT is programmed in C++ programming language and uses the Qt Framework by statically linking it to the RAT on 32- and 64-bit versions.
MagicRAT is a Windows rat operated by Lazarus Group and Silent Chollima.
Background
Talos reports that MagicRAT is written in C++ and statically links the Qt Framework into both its 32- and 64-bit builds. Qt is normally a library for building graphical interfaces, yet this RAT has no GUI at all. Talos believes the choice was meant to bloat code complexity and frustrate manual reverse engineering, while also undermining machine-learning and heuristic detection given how rarely malware is written with Qt. Qt classes appear throughout the codebase, and the configuration is held dynamically in a QSettings object that is eventually persisted to disk, a standard behavior of that class.
MagicRAT hands the operator a remote shell for running arbitrary commands on the victim machine, and lets them rename, move and delete files on the host. Operators can also set how long the implant sleeps, swap out its C2 URLs and uninstall the implant from the compromised system.
Source: Malpedia (Fraunhofer FKIE).