The new malware, CrystalRAT.

The new malware, CrystalRAT, comes with a variety of capabilities to control machines, steal data, and harass victims.

There are many different types of remote access trojan malware, some of which have strange features such as this one.

According to a report by Bleeping Computer, a research team from Kaspersky, a well-known antivirus software developer, has detected the sale of a new RAT malware, CrystalRAT, as rental malware or MaaS (Malware-as-a-Service). The distribution is split into multiple levels with different features than renting or trading software as usual. This malware has been heavily promoted through the famous chat service Telegram and video viewing platforms like Youtube.

According to the research team, this malware has similar properties to a data theft type malware or a half-RAT Infostealer called WebRAT. The malware is built on the basis of the Go language. It has a friendly user-friendly panel screen that comes with a tool to create files for sending malware (Payload Builder) that can add a lot of auxiliary features to files created with this tool, such as Executable Customization, Geoblocking, and anti-analysis. ), such as Anti-Debugging, VM or Virtual Machine, and Proxy Detector. Payloads created from this tool are compressed in Zlib and encrypted with a ChaChaCha20 algorithm.

In the field of malware, the malware contacts the C2 or Command and Control server through the WebSocket channel to send the data of the malware-infected machine system back to the C2 server, make the data of the machine (Profiling), and closely track the malware-infected machine (Tracking). The ability to perform the malware is divided into many different Component and Module elements, such as

The Infostealer, although disabled by the development team to await upgrades, has detected that it has the ability to steal data from web browsers built on Chromium. Using a number of tools, such as ChromeElevator Tool, Yandex, and Opera, not only has the ability to steal data from desktop applications such as Steam, Discord, and Telegram.

The Remote Access module runs commands via CMD, uploads files from the victim's machine, searches system files, and controls the real-time machine via VNC (Virtual Network Computing).

There are tools that allow spying malware or Spyware to secretly record images and sounds of victims through the camera and microphone of the victim.

It has the ability to trap printing with the Keyloger implementation and steal and modify data on the Clipboard via the Clipper Tool, which is often used to detect, find the address information of the Crypto Curren C wallet (Wallet) and shuffle it into that of a hacker instead.

But this malware is more special than others: a Prank feature has been added for hackers to bully their victims. This feature can do the following:

Change the background scene or Wallpaper on the machine

Change Angle (Display) on the victim's machine

Order the shutdown machine

Change the pattern of mouse button usage

Disable mouse and keyboard

Show fake Notification

Change the position of the cursor on the screen.

Hide elements on the screen, such as Taskbar, on-screen icon, Task Manager, and Command Prompt.

Open the chat screen to talk to the victim.

# Trending # Lemon 8 Howtoo # lemon 8 diary # Malware # freedomhack