New SectopRAT Trojan creates hidden second desktop to control browser sessions

guest · Nov 21, 2019

New SectopRAT Trojan creates hidden second desktop to control browser sessions
The Trojan makes sure the second desktop is hidden from sight
November 21, 2019
https://www.zdnet.com/article/new-s...n-second-desktop-to-control-browser-sessions/

A new Trojan, SectopRAT, has appeared in the wild which is able to launch a hidden secondary desktop to control browser sessions on infected machines.

The new malware was first spotted by MalwareHunterTeam. In a tweet on 15 November, MalwareHunterTeam said the C# malware, compiled on 13 November, was able to "create [a] hidden desktop and run [a] selected browser there with full control."
This caught the attention of cybersecurity researchers from G Data, who were able to obtain a second sample, compiled on 14 November, later submitted to Virustotal.

The first SectopRAT sample is signed by Sectigo RSA Code Signing CA and uses a Flash icon, whereas the second is not signed.
Once connected with its C2, the Trojan can be commanded to either stream an active desktop session or create a secondary one, hardcoded as "sdfsddfg," which is hidden from view. [...] The malware is also able to send computer information back to the C2, [...]
Click to expand...

Chrome, Firefox or Internet Explorer browser sessions can be launched. The malware is also able to change browser configurations to disable security barriers and sandboxes. However, the browser paths are hardcoded and do not use environmental variables.

"Despite obvious flaws like using hardcoded paths without environmental variables [...] show some internal knowledge that is far from a greenhorn," the researchers say. "It is quite possible that the first samples in the wild are merely for testing."
Click to expand...

G Data: New SectopRAT: Remote access malware utilizes second desktop to control browsers

Rasheed187 · Nov 23, 2019

That's why we need a way to monitor browser process execution, too bad you still can't do this with EXE Radar.

Log in or Sign up

New SectopRAT Trojan creates hidden second desktop to control browser sessions

guest Guest

Rasheed187 Registered Member

Log in or Sign up

New SectopRAT Trojan creates hidden second desktop to control browser sessions

guest Guest

Rasheed187 Registered Member

Useful Searches