value: The attackers uploaded Remote Utilities RAT tool to a third-party compromised website to be used if the victim environment won’t have a remote administration tool installed.
  
name: Stage Capabilities: Upload Tool