sb-as logo
Story image

Cobian RAT author crowdsourcing malware botnet distribution

07 Sep 2017

Zscaler has discovered a remote access Trojan (RAT) designed by an author who appears to be crowdsourcing the payload and infection spread.

Researchers have been watching the Cobian RAT since February this year. It had been advertised for free in multiple underground markets for cybercriminals and had many similarities to the njRAT/H-Worm family, of which there are many variants.

The njRAT Trojan is one of the most successful of its kind in the wild because it comes with online support and tutorials for cybercriminals, Zscaler says.

It has reportedly been used in attacks against the international energy sector and has been spotted in Australia and Asia.

The new Cobian RAT is injected with a backdoor that fetches command & control information from a Pastebin URL that is controlled by the malware’s author. The author can then control the systems infected by the payloads.

Notably, researchers found that the malware uses secondary operators to form the payload and spread infections, suggesting a crowdsourcing model to its distribution.

Because the malware has a backdoor, the author can control all systems in the Cobian botnets, and change the command & control server information that secondary operators configured.

“The original author of the RAT builder is assuming that there will be some testing performed by the second-level operators and that they will mostly likely use the same system for both bot client and server applications,” researchers state.

The Cobian RAT has been spotted in the wild. It appears to be from a compromised Pakistan defence and telecommunications solution website.

The RAT was hidden in a ZIP archive as a Microsoft Excel spreadsheet. What’s more, the file’s certificate masquerades as VideoLAN, the company responsible for VLC media player.

In amongst the bot configuration, researchers noticed more similarities between Cobian and njRAT.

The Cobian bot contains a keylogger and has access to screen capture, webcam, voice recorder, file browser, remote command shell, dynamic plugins and install/uninstall functions.

Amongst other supported commands are the ability to run executables or scripts from local disks or remote URLs, remote desktops, chat, password stealer and system manager.

“It is ironic to see that the second level operators, who are using this kit to spread malware and steal from the end user, are getting duped themselves by the original author. The original author is essentially using a crowdsourced model for building a mega Botnet that leverages the second level operators Botnet,” ressearchers conclude.

Story image
Check Point acquires Odo Security to bolster remote security offering
The deal will integrate Odo’s remote access software with Check Point’s Inifinity architecture, bolstering the latter company’s remote security capabilities in a time where working and learning from home has become the norm, and looks to largely remain that way in the near future.More
Story image
McAfee finds vulnerabilities in 'temi' the videoconferencing robot
Temi is commonly used in environments including businesses, healthcare, retail, hospitality, and other environments including the home.More
Story image
CrowdStrike integrates with ServiceNow program to bolster incident response
As part of the move, users can now integrate device data from the CrowdStrike Falcon platform into their incident response process, allowing for the improvement of both the security and IT operation outcomes.More
Story image
Cohesity announces integrated, automated disaster recovery
The new solution is integrated with the company’s existing backup and continuous data protection capabilities.More
Story image
Video: 10 Minute IT Jams - The benefits of converged cloud security
Today, Techday speaks to Forcepoint senior sales engineer and solutions architect Matthew Bant, who discusses the benefits of a converged cloud security model, and the pandemic's role in complicating the security stack in organisations around the world.More
Story image
Global attack volume down, but fraud and cyber threats still going strong
“The move to digital, for both businesses and consumers, has been significant. Yet with this change comes opportunity for exploitation. Fraudsters look for easy targets: whether government support packages, new lines of credit or media companies with fewer barriers to entry."More