Hackers sell NtKiller malware in Dark Web

NtKiller malware claims hackers can in turn disable EDR

To protect computers from malware, they can't escape the use of tools like anti-viruses or more complete tools like EDR (Endpoints Detection and Response), but hackers are starting to take it half a step again with a new malware that has the ability to deal with these tools.

According to a report by the website Cyber Security News, a research team from KrakenLabs, a cybersecurity expert firm, has detected that hackers, or a group of hackers called AlphaGhoul, have developed but distributed a new malware, NtKiller, through the underground black market, boasting that the malware has the ability to shut down a variety of popular security systems such as Microsoft Defender, ESET, Kaspersky, Bitdefender, and Trend Micro, among others. In addition, the malware also has an Aggressive Mode for breaking through EDR-grade tools for enterprise use. Also, the distribution of malware will be sold as a module, starting with the core module sold at US $500 (THB 15,620), while other add-ons like UAC Bypass and Rootkit will be sold for US $300 per add-on (THB 9,370.20).

For technical data, the malware will create persistence on the system, or Persistence, by automating itself during the boot up phase to run before the installed security system starts. It also has anti-Debugging and anti-analysis capabilities, making it impossible to be monitored by cyber researchers.

As for capabilities like UAC, Bypass will break through the User Account Control protection system to allow malware to access a high level of permissions. At the same time, adding permissions will not result in alerting victims that an invasive foreign user has upgraded permissions on the system, while Rootkit's part will be in terms of creating Persistence and stealth, quietly hiding inside the system at the same time.

This is all just an analysis of the hackers' boasting ads inside the underground website. It is not possible to confirm whether all these capabilities are true, as the research team has no access to the real malware at this time.

# Trending # Lemon 8 Howtoo # Drug sign with lemon8 # lemon 8 diary # freedomhack