This report is about a RAT (remote access tool) generator called Blackremote. The generator has been recently advertised and sold in underground forums using cryptocurrencies such as Bitcoin as the medium of exchange. The executable being generated has remote access capabilities allowing bad actors to modify the system and capture sensitive data.
The generated malware allows bad actors with a myriad of both surveillance powers and malicious features. Some of the surveillance abilities include key logging, webcam manipulation such as taking photos or video recording, microphone listening, and more. There are a few features that are quite interesting to review. One feature allows the bad actor to modify the Hosts file which enables the addition of redirects, domain name resolution, and blocking IP addresses and/or domains. There’s also a built-in scripting tool that gives attackers the option to run a few supported scripts such as PowerShell, Batch, VBS, and HTML.
The management client for controlling the malware provides a method of connection logging and configuration parameters. The bad actor can refuse connections from known virtual machines and set up certain actions. The actions available are as follows: mail notifications for connections, alarms if a certain PC successfully connects, ability to save logs, and more. There’s been great care taken to obfuscate the building client as much as possible to deter any attempts to analyze the software.
The most common method of successful infection is through spam emails.
May result in unwanted network traffic and surveillance of user activity. The exfiltration of data is very likely given the variety of options available to the bad actor. There’s a high likelihood that the bad actor will run malicious scripts or download other forms of malware onto the infected system.
Sources
AlienVault OTX (Open Threat Exchange) IOC List