TeleRAT, a new Android Trojan that uses Telegram for data exfiltration

Minimalist · Mar 22, 2018

Security experts at Palo Alto Networks discovered a new Android Trojan dubbed TeleRAT that uses Telegram Bot API to communicate with the command and control (C&C) server and to exfiltrate data.
Click to expand...

http://securityaffairs.co/wordpress/70551/malware/telerat-android-trojan.html

Minimalist · Jun 18, 2018

New Telegram-abusing Android RAT discovered in the wild

ESET researchers have discovered a new family of Android RATs (Remote Administration Tools), that has been abusing the Telegram protocol for command and control, and data exfiltration.

Investigating what at first seemed like increased activity on the part of the previously reported IRRAT and TeleRAT, we identified an entirely new malware family that has been spreading since at least August 2017. In March 2018, its source code was made available for free on Telegram hacking channels, and as a result, hundreds of parallel variants of the malware have been circulating in the wild.

One of these variants is different from the rest – despite the freely available source code, it is offered for sale on a dedicated Telegram channel, marketed under the name HeroRat. It is available in three pricing models according to functionality, and comes with a support video channel. It is unclear whether this variant was created from the leaked source code, or if it is the “original” whose source code was leaked.
Click to expand...

https://www.welivesecurity.com/2018/06/18/new-telegram-abusing-android-rat/

guest · Aug 2, 2018

Analyzing the Telegram-based Android remote access trojan HeroRAT
August 02, 2018
https://securityaffairs.co/wordpress/74996/breaking-news/herorat-rat-analysis.html

HeroRAT appeared very active in Iran where it was spreading through third-party app stores, through tainted social media and messaging apps.

ESET experts speculate that the HeroRAT borrows the source code of a malware appeared in the hacking community in March 2018, however, it has some characteristics that distinguish it different from IRRAT and TeleRAT. One of these features is the usage of the Xamarin Framework and TeleSharp Library for the development of the RAT.

Further details on the RAT analyzed by CSE Cybsec, including the IoCs and Yara Rules are available in the report published by researchers at ZLAb.
Click to expand...

ZLAB Malware Analysis Report (PDF): http://csecybsec.com/download/zlab/20180802_CSE_HeroRAT.pdf

Trooper · Aug 3, 2018

Crazy stuff. Nothing new though since wherever there is a way to exploit something, it shall be exploited.

Log in or Sign up

TeleRAT, a new Android Trojan that uses Telegram for data exfiltration

Minimalist Registered Member

Minimalist Registered Member

guest Guest

Trooper Registered Member

Log in or Sign up

TeleRAT, a new Android Trojan that uses Telegram for data exfiltration

Minimalist Registered Member

Minimalist Registered Member

guest Guest

Trooper Registered Member

Useful Searches