Report: RAT Generator "Blackremote"

Blackremote Overview

This report is about a RAT (remote access tool) generator called Blackremote. The generator has been recently advertised and sold in underground forums using cryptocurrencies such as Bitcoin as the medium of exchange. The executable being generated has remote access capabilities allowing bad actors to modify the system and capture sensitive data.

Tactics, Techniques, Procedures

The generated malware allows bad actors with a myriad of both surveillance powers and malicious features. Some of the surveillance abilities include key logging, webcam manipulation such as taking photos or video recording, microphone listening, and more. There are a few features that are quite interesting to review. One feature allows the bad actor to modify the Hosts file which enables the addition of redirects, domain name resolution, and blocking IP addresses and/or domains. There’s also a built-in scripting tool that gives attackers the option to run a few supported scripts such as PowerShell, Batch, VBS, and HTML.

The management client for controlling the malware provides a method of connection logging and configuration parameters. The bad actor can refuse connections from known virtual machines and set up certain actions. The actions available are as follows: mail notifications for connections, alarms if a certain PC successfully connects, ability to save logs, and more. There’s been great care taken to obfuscate the building client as much as possible to deter any attempts to analyze the software.

The most common method of successful infection is through spam emails.

Impact

May result in unwanted network traffic and surveillance of user activity. The exfiltration of data is very likely given the variety of options available to the bad actor. There’s a high likelihood that the bad actor will run malicious scripts or download other forms of malware onto the infected system.

Recommendations

• Encouraged: Implement blocks using the IOC list linked below
• Consider user training to avoid successful phishing attacks as the most common method of entry for this malware uses such a tactic
• Consider running Windows Sysinternals to ensure the proper use of system and application processes on your devices
• Utilize network tools or appliances that perform deep packet inspection with full packet capture to detect anomalies

Sources

AlienVault OTX (Open Threat Exchange) IOC List

Palo Alto Unit 42 Analysis