H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[SQLRat](https://attack.mitre.org/software/S0390) is malware that executes SQL scripts to avoid leaving traditional host artifacts. [FIN7](https://attack.mitre.org/groups/G0046) has been observed using it.(Citation: Flashpoint FIN 7 March 2019)

Labels

malware

9 recorded

Relationships

uses

from FIN7

Group

uses

to Command Obfuscation

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Malicious File

Technique

uses

to PowerShell

Technique

uses

to Scheduled Task

Technique

uses

to Windows Command Shell

Technique

3 external

References

mitre-attack

S0390

open

SQLRat

—

Flashpoint FIN 7 March 2019

https://www.flashpoint-intel.com/blog/fin7-revisited-inside-astra-panel-and-sqlrat-malware/

open