KGB RAT Uses FUD Crypter to Evade Windows Defender and Spy on Victims

KGB RAT, a Windows remote access trojan marketed as legitimate administration software, combines surveillance, credential theft, and configurable malicious functions with a built-in crypter advertised to evade Windows Defender.

Researchers identified unobfuscated payloads, obfuscated variants, and encrypted loaders that reconstruct malware during execution.

This distinction matters: the crypter conceals the underlying payload, while the deployed RAT performs activities that behavioral monitoring can expose.

Group-IB reported detecting analyzed samples despite their obfuscation or delivery through droppers.

Most examined samples were x86 .NET executables written primarily in VB.NET.

Static analysis found similarities to NjRAT 0.7D Lime Edition, suggesting KGB RAT repackages capabilities from an established commodity malware family rather than representing an entirely novel platform.

Existing NjRAT signatures also matched the analyzed family.

The developers advertise daily crypter updates, multiple payload formats, and a generator intended to produce distinct stubs for successive builds.

Supported output formats reportedly include EXE, BAT, HTA, and REG. Advertisements also claim permanent Defender disabling and antivirus bypass, but those promises should remain separate from independently observed execution behavior.

KGB RAT’s evasion extends beyond packing. Researchers documented virtual machine checks, analysis-tool detection, runtime deobfuscation, and delayed execution.

One analyzed process invoked a 600-second sleep, potentially outlasting short sandbox observation windows.

Other checks examined hardware characteristics, printers, USB history, and user activity to identify artificial environments.

During observed execution, the initial sample copied and relaunched itself as svchost.exe inside the user’s temporary directory.

The installed copy created a scheduled task named ChromeUpdate, configured to execute at logon while requesting the highest available privilege level.

Group-IB’s October 14 analysis links the malware, to NjRAT and documents persistence, keylogging, reconnaissance, and victim notifications through Telegram. Its “fully undetectable” branding remains a seller claim, not an established guarantee.

KGB RAT Malware

The familiar filename and updater-style task name disguise an otherwise suspicious persistence chain.

The malware also modified Explorer settings to suppress protected-file visibility and invoked PowerShell to refresh open Explorer windows.

Separately, researchers observed security-zone checking suppression, illustrating how the RAT combines native Windows utilities with registry changes to reduce visible warnings and conceal its installation.

The broader advertised package includes hidden desktop control through HVNC, webcam and microphone access, browser password recovery, and ransomware functionality, although advertised modules should not be treated as universally enabled.

MDP detonates suspicious files in a controlled, instrumented environment that captures the full behavioral chain of a sample from initial execution through payload deployment, C2 registration, and post-infection activity.

Surveillance capabilities include keystroke collection, screenshots, clipboard monitoring, and credential access. Runtime analysis captured GetAsyncKeyState polling and access to Windows Credential Manager vault files.

KGB RAT separates direct command execution from operator alerts. A dedicated TCP connection supports command-and-control traffic, while Telegram’s Bot API delivers infection notifications containing victim information.

The malware also queries ip-api[.]com for geographic context. These legitimate services are abused infrastructure, not inherently malicious indicators.

An intercepted beacon exposed hostname, username, operating-system details, administrator status, and installed antivirus information.

Researchers also identified configurable cryptocurrency clipboard replacement, enabling operators to substitute attacker-controlled wallet addresses during payment activity.

For defenders, the strongest investigative connection is behavioral: correlate temporary-directory svchost.exe execution, ChromeUpdate task creation, registry tampering, key-state polling, and unexpected outbound communications.

Group-IB’s findings demonstrate why “FUD” should describe criminal marketing rather than immunity from endpoint telemetry, memory inspection, configuration extraction, or behavioral detection across monitored enterprise systems.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.