The ComRAT malware is a remote administration tool and is used by the Turla hacker group. It was first spotted in November 2014. The Trula hacker group is active for more than ten years.
ComRAT malware also known as Agent.BTZ, the first version of it was released in 2007. It becomes infamous after it was used to breach the US military in 2008 .
Turla’s operators known for maintaining a large arsenal of malware includes a rootkit, several complex backdoors aimed at different platforms, including Microsoft Exchange mail servers, and a large range of tools to enable pivoting on a network.
A new variant of ComRAT malware found by researchers in 2017 and it is active as recently as January 2020. Three targets were identified; two of them are ministries of Foreign Affairs and a national parliament.
In addition to document stealing the hacker group runs various commands to gather information about services such as “Active Directory groups or users, the network, or Microsoft Windows configurations such as the group policies.”
All the files associated with ComRAT are stored in a Virtual File System and the VFS is encrypted using AES-256 in XTS mode.
Two Command and Control channels
The most interesting feature with the new version of the malware uses the Gmail web UI to receive commands and exfiltrate data.
So that attackers can bypass some security solutions as the communication not from the malicious domains. Eset published a detailed report with Indicators of compromise .
cvv dump sites dumps and pins