Webhards and Torrents: the New Channels for RAT Malware Propagation in Korea

guest · Oct 22, 2021

RAT malware spreading in Korea through webhards and torrents
October 21, 2021
https://www.bleepingcomputer.com/ne...ading-in-korea-through-webhards-and-torrents/

An ongoing malware distribution campaign targeting South Korea is disguising RATs (remote access trojans) as an adult game shared via webhards and torrents.

The attackers are using easily obtainable malware such as njRAT and UDP RAT, wrap them in a package that appears like a game or other program, and then upload them on webhards.
Click to expand...

WebHard is a popular online storage service in Korea, preferred mainly for the convenience of direct downloads.

Users end up at webhards through Discord or social media posts, but popular storage repositories enjoy a steady stream of daily visitors due to the content that is shared.
As reported by analysts at ASEC, threat actors are now using webhards to distribute a UDP RAT that is disguised as ZIP file containing an adult game.

Upon execution, Game.exe drops a Themida-packed RAT and becomes hidden, while it subsequently creates a new Game.exe file that will run the actual game, convincing the victim that all went well.
Click to expand...

For this campaign, ASEC was unable to sample any of the additional payloads, so this may be a functionality preserved for future deployment or it's just intermittently used.

Webhards are typically unregulated spaces, with no one checking what users upload and share with others on the platform, so whenever you’re pointed to one, be very careful.
ASEC warned about this risk again in June, when actors distributed yet another commodity malware disguised as a platformer game named ‘Lost Ruins’.
Click to expand...

Heimdal Security: Webhards and Torrents: the New Channels for RAT Malware Propagation in Korea

ASEC: UDP RAT Malware Being Distributed via Webhards

Attackers normally use easily obtainable malware such as njRAT and UDP RAT and disguise them as normal programs such as games or adult content for distribution. Similar cases were introduced in the previous ASEC blogs multiple times:

– njRAT Being Distributed through Webhards and Torrents
– njRAT Malware Distributed via Major Korean Webhard
Malware types introduced in the posts above are still being found, and DDoS malware such as Simple UDP RAT is usually used instead of njRAT.
Click to expand...

Log in or Sign up

Webhards and Torrents: the New Channels for RAT Malware Propagation in Korea

guest Guest

Log in or Sign up

Webhards and Torrents: the New Channels for RAT Malware Propagation in Korea

guest Guest

Useful Searches