New CRAT Version Is Storming the Endpoints While Evading Detection

guest · Nov 14, 2020

New CRAT Version Is Storming the Endpoints While Evading Detection
It appears that Lazarus is still the hacker group that is pulling the strings behind CRAT
November 13, 2020
https://www.technadu.com/new-crat-version-storming-endpoints-evading-detection/224621/

A new version of the CRAT malware is circulating, hitting vulnerable endpoints, fetching and deploying additional plugins, and managing to do all that without being detected. CRAT is a malware family that has been previously linked with the Lazarus APT group (North Korea), a highly skillful and knowledgeable group of hackers who are using custom and powerful tools.

The new version of the CRAT was captured and analyzed by researchers of Cisco Talos, and they report seeing new plugins, as well as a new set of detection-evasion techniques.
Click to expand...

The researchers couldn’t discern the distribution vector of the new campaign, but it could be a document carrying malicious macros again.

Among the various problems that CRAT can bring on a target system, ransomware encryption is maybe the worst possible scenario. For this aspect, CRAT fetches a module of the “Hansom” ransomware, locking the files inside archives protected by randomly generated passwords. These passwords are then encrypted using an embedded public key, not the files themselves.
Click to expand...

Cisco Talos: CRAT wants to plunder your endpoints

Cisco Talos has observed a new version of a remote access trojan (RAT) family known as CRAT.

Apart from the prebuilt RAT capabilities, the malware can download and deploy additional malicious plugins on the infected endpoint.

One of the plugins is a ransomware known as "Hansom."

CRAT has been attributed to the Lazarus APT Group in the past.

The RAT consists of multiple obfuscation techniques to hide strings, API names, command and control (C2) URLs and instrumental functions, along with static detection evasion.

The attack also employs a multitude of anti-infection checks to evade sandbox based detection systems.

Click to expand...

Links to Lazarus
Attribution is hard. Although prior reporting has linked CRAT to Lazarus, there has been no solid evidence to back these claims. There are however some aspects of the attack that resemble Lazarus' practices: [...]
Click to expand...

Log in or Sign up

New CRAT Version Is Storming the Endpoints While Evading Detection

guest Guest

Log in or Sign up

New CRAT Version Is Storming the Endpoints While Evading Detection

guest Guest

Useful Searches