New malware campaign spreading a remote access trojan called BitRAT

guest · Jan 4, 2023

BitRAT campaign relies on stolen sensitive bank data as a lure
By Pierluigi Paganini - January 3, 2023

Qualys experts spotted a new malware campaign spreading a remote access trojan called BitRAT using sensitive information stolen from a bank as a lure in phishing messages.
Click to expand...

BitRAT is a relatively new threat advertised on underground marketplaces and forums since Feb 2021, it is offered for $20. The RAT supports the following capabilities: [...]

While investigating multiple lures for BitRAT, the researchers discovered that a threat actor had hijacked the IT infrastructure of a Columbian cooperative bank and likely gained access to customers’ data.
Then the attackers use lures containing sensitive data from the bank to trick victims into installing the malware.
Click to expand...

The threat actors exported the data in weaponized Excel maldocs and used them in phishing emails crafted to trick recipients into opening the file.

“The excel contains a highly obfuscated macro that will drop an inf payload and execute it. The .inf payload is segmented into hundreds of arrays in the macro. The de-obfuscation routine performs arithmetic operations on these arrays to rebuild the payload. The macro then writes the payload to temp and executes it via advpack.dll.” reads the analysis published by the experts. “The .inf file contains a hex encoded second stage dll payload which is decoded via certutil, written to %temp%\ and executed by rundll32. The temp files are then deleted.”
The obfuscated BitRAT loader samples were hosted on a GitHub repository that was created in mid-November 2022.
Click to expand...

Qualys: BitRAT Now Sharing Sensitive Bank Data as a Lure

By Akshat Pradhan - January 3, 2023
Conclusion
Commercial off the shelf. RATs have been evolving their methodology to spread and infect their victims. They have also increased the usage of legitimate infrastructures to host their payloads and defenders need to account for it.
Click to expand...

Log in or Sign up

New malware campaign spreading a remote access trojan called BitRAT

guest Guest

Log in or Sign up

New malware campaign spreading a remote access trojan called BitRAT

guest Guest

Useful Searches