Antiques surfers on guard. AtlasRAT malware found.

Antiques surfers on guard. AtlasRAT malware found embedded in fake Flash Player

According to the official website of the well-known anti-malware developer Malwarebytes, Malwarebytes has mentioned the detection of a malware distribution campaign of a remote access trojan called AtlasRAT. By virtue of the popularity of old media enthusiasts who still need to use Flash Player to watch or play those media, hackers will create fake websites that claim to have such tools. If someone searches Flash Player on a Search Engine like Google, they have the right to find it and become trapped.

The malware comes in an Executable File, named in imitation of the Flash Player as FlashPlay.Exe, which claims to be a file for installing a tool called "AGE Flash Player." In fact, the file is a loader written by the Delphi language. The malware runs on all In-Memory. This step will be to assemble the real malware file (Payload) on the memory instead of downloading the new file from the C2 or Command and Control server, which is called a malware embedding technique. Fileless

For a real payload with a MainDll.Dll file name, it uses a Self-Signed Certificate (CN = update.Microsoft.Com) to communicate with C2 servers through Transport Layer Security (TLS). A self-signed certificate with a trusted domain impersonation, even if it is not owned by Microsoft and Google. If it is used in a common web browser, it will be rejected with a warning. But for malware written for use with such a particular form of certificate, it will be able to bypass the C2 server immediately.

AtlasRAT malware is known as having the ability to steal a variety of data - by trapping passwords by trapping typing, storing system data as well as collecting a list of all local security software, secretly smuggling stolen data (Exfiltration) through an encrypted channel, and firing the code of a DLL file to misrepresent malware into applications such as WeChat to misrepresent traffic, or using the text feature in it to send fraudulent messages to others.

Of particular concern, the AhnLab research team that detected the campaign predicted that it would not be a one-off campaign, but rather a one-off campaign that would have been sold on the black market or rented (MaaS or Malware-as-a-Service), and that similar malware could be found in the future.

# Trending # lemon 8 diary # Lemon 8 Howtoo # AtlasRAT # freedomhack