FatalRAT Exploits Telegram to Deliver Malicious Links

guest · Aug 2, 2021

FatalRAT Exploits Telegram to Deliver Malicious Links
AT&T Alien Labs: RAT Uses Defense Evasion Techniques
August 2, 2021
https://www.databreachtoday.com/fatalrat-exploits-telegram-to-deliver-malicious-links-a-17199

A remote access Trojan is being distributed via download links for software or media articles on Telegram channels, according to researchers at AT&T Alien Labs.

The malware, dubbed FatalRAT, can be remotely executed and can perform defense evasion techniques, obtain system persistence, log user keystrokes, collect system information and exfiltrate data over an encrypted command-and-control channel, the researchers say.
AT&T Alien Labs reports discovering samples of FatalRAT in the wild in the past few months, but it does not say how many victims have been affected.
Click to expand...

Before the malware fully infects a system, it runs several tests, looking for the existence of virtual machine products and checking disk space and the number of physical processors, AT&T Alien Labs notes.
The RAT also disables the user's ability to lock the computer through the CTRL+ALT+DELETE command by using the registry key DisableLockWorkstation.

As a defense evasion technique, the malware identifies all security products running on the machine by iterating through all running processes and searching for the existence of a predefined list of security products, the researchers note.
Click to expand...

"The malware has several routines to handle different browsers," Caspi notes. "Some of these routines include deleting user information for specific browsers (Edge, 360Secure Browser, QQBrowser, SogouBrowser, and Firefox). For Chrome, it will query for user information and then delete the content. Deleting saved information will force the user to input, for example, user and password, which the malware can capture with its keylogger."
Click to expand...

Log in or Sign up

FatalRAT Exploits Telegram to Deliver Malicious Links

guest Guest

Log in or Sign up

FatalRAT Exploits Telegram to Deliver Malicious Links

guest Guest

Useful Searches