RATANKBA is a remote controller tool used by Kim Jung Un'sl Lazarus Group.

RATANKBA has a graphical user interface to allow the attacker to issue jobs to perform on the infected machines.

RATANKBA uses the command reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings"

RATANKBA gathers the victim’s IP address via the ipconfig -all command.