Updated GravityRAT Malware Adds Advanced AV Detection

Minimalist · Apr 30, 2018

Researchers tracking the evolution of the remote access trojan GravityRAT warn that developers behind the malware have made key changes to the RAT’s code in an attempt to decrease antivirus detection.

“We’ve seen file exfiltration, remote command execution capability and anti-vm techniques added throughout the life of GravityRAT. This consistent evolution beyond standard remote code execution is concerning because it shows determination and innovation by the actor,” wrote Cisco Talos researchers Warren Mercer and Paul Rascagneres in a technical write-up posted last week.
Click to expand...

https://threatpost.com/updated-gravityrat-malware-adds-advanced-av-detection

EASTER · Apr 30, 2018

Those forced intruder actors have been at this game a long time. I infiltrated a number of them (their private forums/sites) back when on 98 to XP. Simply because they kept me up nights on end every single month when I was Mod in a popular global security forum (think adaware) and with another expert far greater talented, we both helped users who came limping in with infected machines.

And the greater percentage of those tampered machines all had some up-to-date AV, but little matter.

The other side was always picking every piece of code and file action they could muster to ride under AV's radar.

They was successful then, and apparently they now have even more experience to build on to carry out new techniques to some success even today.

guest · Oct 19, 2020

Android, macOS Versions of GravityRAT Spyware Spotted in Ongoing Campaign
October 19, 2020
https://www.securityweek.com/android-macos-versions-gravityrat-spyware-spotted-ongoing-campaign

Initially detailed in 2018, the RAT was previously employed in attacks targeting the Indian military, as part of a campaign that is believed to have been active since 2015. Targeting Windows systems, the tool has mainly been used for spying purposes.

In a report published on Monday, Kaspersky reveals that the malware’s authors have invested a lot into making their tool cross-platform, and that, as part of an ongoing campaign, both Android and macOS are now being targeted, in addition to Windows.
The investigation into the new samples has revealed over 10 variants of GravityRAT, which have been distributed masquerading as legitimate apps, including secure file sharing software and media players.

“Our investigation indicated that the actor behind GravityRAT is continuing to invest in its spying capacities. Cunning disguise and an expanded OS portfolio not only allow us to say that we can expect more incidents with this malware in the APAC region [...]” Tatyana Shishkova, security expert at Kaspersky, said.
Click to expand...

Kaspersky: GravityRAT: The spy returns

In 2018, researchers at Cisco Talos published a post on the spyware GravityRAT, used to target the Indian armed forces.

In 2019, on VirusTotal, we encountered a curious piece of Android spyware which, when analyzed, seemed connected to GravityRAT. The cybercriminals had added a spy module to Travel Mate, an Android app for travelers to India, the source code of which is available on Github.
Conclusion
In 2019, The Times of India published an article about the cybercriminal methods used to distribute GravityRAT during the period 2015-2018. Victims were contacted through a fake Facebook account, and asked to install a malicious app disguised as a secure messenger in order to continue the conversation. Around 100 cases of infection of employees at defense, police, and other departments and organizations were identified.
Click to expand...

It is safe to assume that the current GravityRAT campaign uses similar infection methods — targeted individuals are sent links pointing to malicious apps.
Click to expand...

Log in or Sign up

Updated GravityRAT Malware Adds Advanced AV Detection

Minimalist Registered Member

EASTER Registered Member

guest Guest

Log in or Sign up

Updated GravityRAT Malware Adds Advanced AV Detection

Minimalist Registered Member

EASTER Registered Member

guest Guest

Useful Searches