Thread Rating:
  • 1 Vote(s) - 5 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Innovative Spy Trojan Targets European Diplomatic Targets
#1
Information 
Quote:A fresh malware trojan has emerged, built from the same code base as the stealthy COMPFun remote access trojan (RAT). The malware is using spoofed visa applications to hit diplomatic targets in Europe and may be the work of the Turla APT.
 
According to researchers at Kaspersky, the fake visa application harbors code that acts as a first-stage dropper. That dropper in turn fetches the main payload, which logs the target’s location, gathers host- and network-related data, performs keylogging and takes screenshots. It also monitors USB devices and can infect them in order to spread further, and it receives commands from the command-and-control (C2) server in the form of HTTP status codes.
 
“In other words, it’s a normal full-fledged trojan that is also capable of propagating itself to removable devices,” researchers wrote in a Thursday analysis. “As in previous malware from the same authors…to exfiltrate the target’s data to the C2 over HTTP/HTTPS, the malware uses RSA encryption. To hide data locally, the trojan implements LZNT1 compression and one-byte XOR encryption.”
 
As for that “previous malware,” the code base for the new RAT is similar to a COMPFun successor known as Reductor, which Kaspersky observed last year infecting files on the fly to compromise TLS traffic. The firm attributes the new RAT to the same threat actor – which is perhaps the Turla APT.

Read more: https://threatpost.com/innovative-spy-tr...ts/155763/
[-] The following 2 users say Thank You to silversurfer for this post:
  • dinosaur07, harlan4096
Reply


Forum Jump:


Users browsing this thread: 1 Guest(s)
[-]
Welcome
You have to register before you can post on our site.

Username/Email:


Password:





[-]
Recent Posts
The slowest Meteor Lake spotted: Intel C...
Intel Core Ultra 5...harlan4096 — 12:47
Microsoft Edge fixes 0-day vulnerability...
Microsoft released...harlan4096 — 10:12
AnyDesk 8.0.9
AnyDesk 8.0.9:   ...harlan4096 — 10:10
AMD Confirms RDNA 3+ GPU Architecture F...
AMD Zen5-based Strix...harlan4096 — 10:08
Adobe Acrobat Reader DC 24.001.20629 (Op...
Adobe Acrobat Read...harlan4096 — 10:06

[-]
Birthdays
Today's Birthdays
No birthdays today.
Upcoming Birthdays
No upcoming birthdays.

[-]
Online Staff
There are no staff members currently online.

>