Windows 10 to Give More Privacy Enhancements including App Permission Popup

By

-

September 14, 2017

With the last windows update on April 11, a set of privacy enhancements helped in improving your privacy with Windows 10. With the next major update, Fall Creators Update(FCU) will be provided prompt before utilizing the app.

Microsoft has implemented those privacy changes into the setup process at the first one they gave direct access to privacy statement in the setup process.

Also Read Windows Registry Analysis – Tracking Everything You Do on the System

And the second one, while installing a new device, the Learn More page on the privacy settings screen enables you to jump to specific settings for location, speech recognition, diagnostics, tailored experiences, and ads while you choose your privacy settings.

It helps you define the specific feature by simply using Learn More button, which makes all the privacy information readily available for the users and to keep users more informative.

Control over Application windows 10

With the new enhanced privacy settings users will get transparent control over the application, from Fall Creators Update and it prompt users for access to their camera, microphone, contacts, and calendar.

Starting with the Fall Creators Update, we’re extending this experience to other device capabilities for apps you install through the Windows Store. You will be prompted to provide permission before an app can access key device capabilities or information such as your camera, microphone, contacts, and calendar, among others.

App permission prompts will only apply to apps installed after the Fall Creators Update. Microsoft to announce these privacy changes coming next month in the Fall Creators Update. Windows Insiders will get an early look of some of these changes in the coming weeks.

Also Read Exploit Windows Remote PC with EternalBlue & DoublePulsar Exploit through Metasploit

ZERODIUM Hosts Tor Browser Zero-Day Bounty Program

By

Gurubaran

-

September 13, 2017

ZERODIUM Hosts Tor Browser Zero-Day Bounty Program

ZERODIUM is known for paying premium bounties and rewards to security specialists to gain their unique and beforehand unreported zero-day investigation affecting major working operating systems, software, and devices.

Today ZERODIUM hosts Tor Browser Zero-Day Bounty and it is offering $1,000,000 for Zero-day exploits with Tor on Linux and Windows.And the bug bounty program is open up to November 30th, 2017 at 6:00 pm EDT and may be it closed in prior if the total payout reaches $1,000,000.

Exploiting browser vulnerabilities getting harder every day and this initiative will motivate security researchers to build new browser exploits. ZERODIUM sets the bar even higher with a new technical challenge: develop a fully functional zero-day exploit for Tor Browser with JavaScript BLOCKED!

Also read Deep Web Browser Tor Now With More Security and Compatibility

Submission Process

ZERODIUM estimates and verifies all submitted research inside one week or less. Payments are made in one or various installments by wire transfer or using crypto-currencies such as Bitcoin (in specific cases only).

The first installment is made within one week or less. For more detail, researchers should contact them with their PGP key.

ZERODIUM Payouts

ZERODIUM payouts for qualified zero-day abuses extend from $5,000 to $1,500,000 per submission. The sums paid by ZERODIUM to specialists to procure their unique zero-day abuses rely upon the fame and security quality of the influenced software/system, and also the nature of the submitted exploit (full or partial chain, supported versions/systems/architectures, reliability, bypassed exploit mitigations, default vs. non-default component, process continuation, etc).

Tor Browser on Tails 3.x (64bit) and Windows 10 RS3/RS2 (64bit) : RCE and LPE to Root/SYSTEM without JavaScript $250,000 and RCE Only (No LPE) without JavaScript $185,000.
Tor Browser on Tails 3.x (64bit) and Windows 10 RS3/RS2 (64bit) : RCE+LPE to Root/SYSTEM with JavaScript $125,000 and RCE Only (No LPE) with JavaScript $85,000.
Tor Browser on Tails 3.x (64bit) OR on Windows 10 RS3/RS2 (64bit) : RCE+LPE to Root/SYSTEM without JavaScript $200,000 and RCE Only (No LPE) without JavaScript $175,000.
Tor Browser on Tails 3.x (64bit) OR on Windows 10 RS3/RS2 (64bit) : RCE+LPE to Root/SYSTEM with JavaScript $100,000 and RCE Only (No LPE) without JavaScript $75,000.

Over 1.65 Million Users Infected By Cryptocurrency Malware Miners In 2017

By

Gurubaran

-

September 13, 2017

Over 1.65 Million Users Infected By Cryptocurrency Malware Miners In 2017

Malware miners are in the raise starting from this year, attackers using various social engineering and more sophisticated attacks such as EternalBlue Which results in attackers getting cryptocurrency Malware, while their victim’s computer systems experience a dramatic slowdown due to the mining process.

Over the last month alone, experts from Kaspersky labs have detected several large botnets designed to profit from concealed crypto mining including growing number of attempts.

In 2013 it was around 205,000, it increased in 2014 by 701,000 and in 2017 a dramatic increase within the first eight months it reached 1.65 million.

Also Read: Fileless Cryptocurrency Miner that affects Windows Machine Through WMI and EternalBlue

Exploiting Methods Cryptocurrency Malware Miners

Attackers use to install miners either by using that are wide spread by Social Engineering Methods and exploiting vulnerabilities like Eternalblue. In Last June attackers even targeted Raspberry Pi for Mining Cryptocurrency.

Attackers use to send ads URL through social Messengers like Telegram and once the user downloads builder from the link it drops the miner with some additional features to the system.

Generally, miners are hard to detect due to of it stealthy nature, even they have additional features like automatic launch every time the computer is switched on, and concealed operation.

Security experts from Kaspersky detected more than 5,000+ computers with miner without user’s knowledge.

The user downloads an installer from a file hosting service under the guise of a freeware program or keys to activate licensed products.
When launched, the installer downloads the miner’s dropper (exe) to the victim computer.

Minergate installation

The dropper writes Minergate and the tool exe to the hard drive, using srvany.exe when the system boots to launch the miner as a service named windows driver.exe.
The dropper creates an additional service named exe which ensures the continuous operation of Minergate, if Minergate is deleted, the dropper restores it on the hard drive.

Most of the miners mining are monero (XMR) and zcash which ensures anonymity of transactions.The expansion of the cryptocurrency exchange has led to a volatile growth in cases where miners are installed without the user’s knowledge.

Banking Trojan Called “EMOTET” Re-emerging to Steal Username And Password

By

Balaji

-

September 13, 2017

Banking Trojan Called “EMOTET” Re-emerging to Steal Username And Password

A Banking Trojan called “EMOTET” Re-emerging again with New Capabilities that stealing personal information such as username and Password via Network Sniffing method.

Initially, EMOTET Discovered on 2014 when it has similar futures often rely on form field insertion or phishing pages to steal information.

There is 2 main Reason for re-emerging this EMOTET Malware Even the Malicious activities are more similar when compared to earlier Variant.

First one is, it’s not choosing the Specific industries to attack instead of that, it affected companies come from different industries, including manufacturing, food and beverage, and healthcare.

The second one is, it choosing Different Method to spread the variant, for example, Spam Email Campaign and network propagation module that brute forces its way into an account domain using a dictionary attack.

The United States, United Kingdom, and Canada made up the bulk of the target regions, with the US taking up 58% of all our detected infections, while Great Britain and Canada were at 12% and 8% respectively.

Also Read: Beware !! Dangerous RAT’s Called “Adwind, Remcos, Netwire” Delivering via A360 Cloud Drive

How Does EMOTET Stealing the Personal Information

Spam Email Campaign is one of the larger and more effective Method to Spreading the Malware and a higher chance of gaining information.

Initially, EMOTET Malware sending via Malicious Spam Email that indicated as an Invoice payment or Payment Notification which contains Malicious URL.

Once we Click the URL, it leads to Download a Doc file that containing the Malicious Macro file.

Later Macro Execute the Powershell command that is Responsible to Download the EMOTET Malware.

According to Trend Micro Report, once downloaded, EMOTET drops and executes copies of itself into the following folders:

If EMOTET has no admin privileges, it will drop the copies into %AppDataLocal%\Microsoft\Windows\{string 1}{string 2}.exe
If EMOTET contains admin privileges, it will instead drop the copies into System%\{string 1}{string 2}.exe

EMOTET add into Every Registry Entry to Make sure the automatic startup for the Every Execution.

Once Its Started, its will gathering the information such as OS, running Process, Personal Information.

At long last, it will Contact to Command and control server to Share the Collected data that was assembled from a contaminated PC.

From our recent samples of EMOTET malware, we have observed that it has become a Loader Trojan that decrypts and loads any binary coming from its Command & Control (C&C) server. Trend Micro said.

Critical BlueBorne Vulnerability Puts More Than 5 Billion Bluetooth Enabled Devices Under Attack

By

Gurubaran

-

September 12, 2017

Critical BlueBorne Vulnerability Puts More Than 5 Billion Bluetooth Enabled Devices Under Attack

Bluetooth is the leading and most widespread protocol for short-range communications.It is the backbone of short range connectivity in the vast majority of devices in the market.

If you are having Bluetooth enabled devices then you are vulnerable to BlueBorne attack. This attack spreads through the air and attacks Bluetooth devices. All the Bluetooth devices mobile, desktop, and IoT operating systems, including Android, iOS, Windows, and Linux are vulnerable.

BlueBorne Attack Explained

This attack leads attackers to gain complete control over your device and from your device they can migrate to corporate networks and even to most secured Air-gapped computers.

Also Read Everything you Need to Know About The Evolution of Locky Ransomware

Security Experts from Armis Labs has identified eight vulnerabilities which can be the part of the attack vector and they published a Whitepaper.

1. Linux kernel RCE vulnerability – CVE-2017-1000251
2. Linux Bluetooth stack (BlueZ) information Leak vulnerability – CVE-2017-1000250
3. Android information Leak vulnerability – CVE-2017-0785
4. Android RCE vulnerability #1 – CVE-2017-0781
5. Android RCE vulnerability #2 – CVE-2017-0782
6. The Bluetooth Pineapple in Android – Logical Flaw CVE-2017-0783
7. The Bluetooth Pineapple in Windows – Logical Flaw CVE-2017-8628
8. Apple Low Energy Audio Protocol RCE vulnerability – CVE-2017-14315

The worst part of the attacks is that user not required to set in discoverable mode or to be paired with attackers device and later not required to Authorize the connection.

Linux Take Over

Armis said Previous works focused on finding potential issues in the Bluetooth specification itself, showing the weakness of the encryption key exchange procedures in Bluetooth versions. But these new vulnerabilities are at the execution level, bypassing the various authentication mechanisms, and empowering a total takeover of the target device.

Security patches

Unlike Android and Windows, iOS does not allow silent authentication to take place via “Just Works” – once an attacker attempts authentication through “Just Works”, the user of the targeted device is informed that a device has initiated pairing with it, and only if the user authorizes the pairing the authentication will succeed.

Android Take Over

All Android phones, tablets, and wearables of all versions are affected and no security patches yet released for Android versions.

Windows versions still Windows Vista are affected and for Windows phones, Microsoft released a Security patch today.

Windows MiTM

All the devices with iPhone and iPad devices less than version iOS 9.3.5 are affected and the issue fixed with iOS 10.And AppleTV with version 7.2.2 and lower are affected.

Defences

Disable Bluetooth as soon as you complete the process, turn it on only when it is required.
Now Android users can check their devices and device around them for vulnerability with the app BlueBorne Detector.

Also read A Highly Sophisticated Victim’s Activities Monitoring Android Spyware “Notorious Pegasus” Discovered

400 Million Windows Computer Vulnerable to “Bashware” Security Software Bypass Attack

By

Balaji

-

September 12, 2017

400 Million Windows Computer Vulnerable to “Bashware” Security Software Bypass Attack

A New Attacking Technique called “Bashware” can able to Bypass all Windows Based Security Software solutions by abusing the New Windows 10 Future called Windows Subsystem for Linux (WSL) and Injecting the Backdoor.

WSL is Compatibility Layer for running Linux binary executable on Windows 10 based Computers that helps to Enable the bash terminal available for Windows OS users.

This Flow can able to allow any Malware’s to bypass the Advanced security solutions, Next Generation Anti Virus software, inspection tools, Anti-Ransomware solutions.

This means that Bashware may potentially affect any of the 400 million computers currently running Windows 10 PC globally.

Also Read : Vault 7 Leaks: CIA Hacking Tool “Angelfire” Secret Document Revealed to Compromise WindowsOS – WikiLeaks

How Does it Bypass the security Futures

Presently Available security software Futures is not that much Effectively Monitoring the processes of Linux Executable’s running on Windows OS.

This will leads to open a backdoor to the hackers and run their Malicious code by abusing the WSL futures which allow hiding from the current intelligence that is given by the security vendors.

Bashware Technique Mainly abusing the “Netcat” utility Futures that is used for reading and writing to network connections using TCP or UDP.

Netcat has some list of Futures including port scanning, transferring files, and port listening, and also it can be used as a backdoor.

In some case, Security Software like Anti-Virus is not allowed the Netcat Futures to get Executed.

By Default, 1337 port is closed because it leads to create a Backdoor and allow the Trojan services to run on the Windows Computers.

Once Bashware Execute the Malware, then it will Bypass all the security solutions and it will later Enable the WSL Future.

https://www.youtube.com/watch?v=4ki6dbEePaw&feature=youtu.be

End of the Execution will Successfully open the Netcat Listener port(1337) that will helps to Attackers to Open a Backdoor.

Windows Inspection Tools such as Task Manager will not Identify the Malicious Payload Process. Instead of that, it can only show the WSL Loader process.

Advanced Process Monitoring Tool also not Detecting the Malicious Payload Process which is Running behind of the WSL Process.

According to Checkpoint Software, a hybrid concept which allows a combination of Linux and Windows systems to run at the same time but allow them to use the features provided by WSL to hide from security products that have not yet integrated the proper detection mechanisms

Security industry to take immediate action and to modify their security solutions to protect against this new method to Mitigate this Actives. Checkpoint Said.

Beware !! Dangerous RAT’s Called “Adwind, Remcos, Netwire” Delivering via A360 Cloud Drive

By

Balaji

-

September 11, 2017

Beware !! Dangerous RAT’s Called “Adwind, Remcos, Netwire” Delivering via A360 Cloud Drive

Widely Used A360 Cloud Drive Platform Abuse for Delivering Adwind, Remcos, Netwire Remote Access Trojans and used as a Malware Distributing Platform by using File sharing site to host Malware.

Nowadays Many Cloud Platform used as a Malware Delivering Platform that by hosting Malicious Files and also being served as a (C&C) infrastructure.

In this case, Command & Control Server Resolved by Free DNS services and it helps to RATs/backdoors that would phone back to their respective command-and-control servers after the Malicious RAT File were Downloaded and Executed.

“A360 is a cloud-based workspace that centralizes, connects and organizes your team and project information across your desktop, the web, and mobile devices.”A360 Drive provides online storage for collaboration. Anyone can create an account for free and given 5GB of space.

According to Trend Micro Report, U.S., South Africa, France, Italy, Germany, Hong Kong, and U.K. the most affected By this Distributed Adwind, Remcos, Netwire RAT’s.

Also Read: Free Remote Access Trojan builder “Cobian RAT” Distributed a Backdoor

How Does These RAT’s Abusing the Cloud Infrastructure

These 3 RAT’s Initially Spreading via the Spam Email Campaign with Different Malware Variant Functions.

Adwind RAT Intially Discovered from as a JAR file (JAVA_ADWIND.JEJPDY) which connect to the C&C Server when the Script get executed. later it will retrieve and exfiltrate multifarious data including credentials, keystrokes, and multimedia files.

NETWIRE RAT Identified through Spam Email Campign with attached (JAVA_KRYPTIK.NPP) file containing a Java ARchive (JAR) along with Exicutable Script and futher analysis confrms that, it has string references NETWIRE remote access tool with keylogging and SOCKS proxy capabilities.

Trend Micro Discovered a Document File that Discovered as “AMMO REQUEST MOD Turkey.doc” (W2KM_DROPPR.XWD) that contains a generic template for macro malware used to abuse the A360 Drive .

Macro File is Encrypted and also Obfusticated Exicutable that will be finally Decrypted.it contains a payloadthat is a malicious PowerShell script that will download a file from A360 Drive and execute it.

The downloaded payload is a Visual Basic obfuscated executable file. Deobfuscating it reveals the Trojanized Remcos remote access tool (RAT), which is advertised, sold, and offered cracked on various websites and forums. Trend Micro said.

Free Remote Access Trojan builder “Cobian RAT” Distributed a Backdoor

By

Balaji

-

September 10, 2017

Free Remote Access Trojan builder “Cobian RAT” Distributed a Backdoor

A Free Remote Access Trojan Builder called “Cobian RAT” Distributed with embedded Backdoor and it it was being offered for free and had a lot of similarities to the njRAT/H-Worm family.

This RAT was Distributing and advertising via some Secret and Darkweb Forums where cyber criminal selling and Buying advance Hacking tools.

This RAT has many similar activities same as njRAT/H-Worm family which is offering for free of cost.

This Backdoored RAT contains Many Advance Futures such as Keylogger, screen capture, webcam, voice Recorder, File Browser, Remote Command Shell and install/uninstall Future.

Also Read: AndroidRat-TheFatRat to Hack and Gain access to Targeted Android Phone

How Does Cobian RAT Works

Initially, Cabian RAT Distributing through online Forums that contains hidden Backdoor that is controlling by the Original Author.

Next Level, RAT Payloads are generated by Builder Kits that is Distributing via Traditional Methods such as Email and Compromised Websites.

Cobian RAT command-and-control server application

Here Pastebin URL used by the Malware author that helps to Pull the information from the Author.

Later, User systems Compromised by the Malicious payload and information will send to the Malware author’s Command & Control Server.

This allows the original author to control the systems infected by the malware payloads that were generated using this backdoored builder kit.

In this case, Malware Author can able to take the full control of the systems that was compromised by the Cobian RAT botnets.

According to Zscaler Analysis, Cobian RAT spreding Via Microsoft Excel spreadsheet using an embedded icon and executable payload was served inside a ZIP archive.

“The executable file is packed using a .NET packer with the encrypted Cobian RAT payload embedded in the resource section. There is a series of anti-debugging checks performed by this dropper payload before decrypting the RAT and installing it on the victim’s system.”

This same RAT used to Compromise the Zscalar Cloud Sandbox from a Pakistan-based defense and telecommunication solution website.

During Zscaler analysis, we observed that when the machine name and username of the systems running the Cobian RAT payload (bot client) and the control server (bot C&C server) are the same, the backdoor module will not be activated and no communication will be sent to the backdoor C&C server.

Second Level Operator using both bot client and server applications in the same system that will lead to hiding the Payload and there will be no traffic generated from the bot client to the backdoor C&C server in this case.Zscaler Said.

Beware!! All Android Versions Up to 7.0 are Vulnerable to Toast Overlay Attack

By

Gurubaran

-

September 9, 2017

Beware!! All Android Versions Up to 7.0 are Vulnerable to Toast Overlay Attack

Cloak & Dagger is a new class of potential attacks affecting Android devices. These attacks allow a malicious app to completely control the UI feedback loop and take over the device — without giving the user a chance to notice the malicious activity.

Security experts from Palo Alto Networks discovered a vulnerability with Android overlay system which allows an attack by Toast type Overlay. Every android devices less than 8.0 are vulnerable to this attack.

Overlay attacks allow an attacker to draw on top of other windows and apps running on the affected device. With this recently found overlay assault does not require a particular permissions or conditions to be compelling. Malware propelling this assault does not have to have the overlay consent or to be introduced from Google Play.

Also Read Millions of Android Phones including latest Versions Vulnerable

With these permissions are in all actuality, various effective assaults can be propelled on the device, including taking credentials, introducing applications silently, and locking the device for the payment.

Cloak and Dagger work by adjusting locales of the screen to change what the victim sees, deceiving them into empowering further permissions or recognizing their input data sources.CVE-2017-0752 was assigned for this vulnerability and it was fixed with security patch released on 2017-09-01, with the fix for a subset of vulnerabilities that are similar across all Android devices.

Vulnerability on Android OS

Experts say Toast overlay is normally used to show a rapid message over all different applications. For instance, a message showing that an email has been spared as the draft when a client explores away without sending an email.

It normally acquires all configuration options with respect to different windows sorts. Be that as it may, our examination has discovered utilizing the Toast window as an overlay window permits an application to compose over the interface of another App without asking for the SYSTEM_ALERT_WINDOW benefit this ordinarily requires.

Vulnerability occurs due to lack of permission checks in code validation with Android AOSP (version <= 7.0) and with Android OS version 7.1 it has multiple layers of mitigation, First layer forcibly due to lack maximum timeout and second mitigation, Android 7.1 allows only one Toast window per app to be shown at a time.

Through the overlay attack, an installed malicious app can fool the user into giving the app Device Administrator permissions. With this, it will have the capability to launch deadly attacks, including:

Locking the device screen
Resetting the device PIN
Wiping the device’s data
Preventing the user from uninstalling the App

Google patched and disclosed this vulnerability on September 5th of 2017.

Everything you Need to Know About The Evolution of Locky Ransomware

By

GBHackers on Security

-

September 8, 2017

Everything you Need to Know About The Evolution of Locky Ransomware

The onset of Locky Ransomware campaign was thought to be evolutionary, but around the clock the campaign has grown to be revolutionary.

We had been monitoring and sharing Locky campaign updates since last month till date. It was observed that almost 23 million messages were sent in last 24-hour period, making it one of the largest malware campaigns seen in the latter half of 2017.

Ransom Notes From Locky Ransomware

The other day 711 million addresses were found to be leaked onto the internet by Online Spambot. The profound dump had found coherencies with recent Locky malspam activities.

The analysis of the thousands of emails sent in the campaign revealed this attack data: 11,625 different IP addresses in 133 different countries are being used to perform this campaign and also Spreading via spoofing Dropbox.

The countries housing the most attack servers are Vietnam, India, Mexico, Turkey, and Indonesia.

The evolution focused on changing tactics mid-game and experimenting with new extensions or new baits to get unsuspecting users to click.

Key Attributes of Locky Ransomware

The late August campaign uses the IKARUS dilapidated version of Locky, which had the .lukitus extension. It spreads using a botnet of zombie computers responsible for coordinating a phishing attack.

While some of the campaigns were also seen spreading with a ZIP attachment that contains a Visual Basic Script (VBS) file that is nested inside a secondary ZIP file.

Once clicked, VBS file initiates a downloader that reaches out to the malicious domain to pull down the latest Locky ransomware.

Additional capricious characteristics included the malicious documents exhibiting harmless behavior in many sandboxes while still infecting end users.

In the latest spam run, the ransomware infection has been resorted to spoofing Dropbox. And accessing the malicious dropbox websites drops Locky payload.

C&C Server Communication for Download Locky Ransomware

Recently we had seen in HoeflerText camapaign, website generates a bogus popup message informing the user the webpage they are trying to view cannot display correctly because the browser is missing the correct “HoeflerText” font.

The message then prompts the user to fix the error. When clicked, receives a JavaScript file which is designed to download and install Locky ransomware

Detection Tips

Locky ransomware uses registry keys (shared in IOCs – Locky Ransomware) for persistence. Therefore, it is important to monitor registry keys for infection detection.
A domain check rule for Dropbox access can be created incorporating to enhance visibility.

Prevention Tips

Most of the trusted antimalware solutions have found quipped with signatures to detect and stop execution of Locky ransomware.
As maldoc is found to be the source in some of the Locky infection, it is advisable to disable the usage of macros in Microsoft Office applications (MS-Word).
A rule can be created for email gateway devices which can generate alerts upon receipt of attachment with MS-Office extensions (xls|xlsx, doc|docx, ppt|pps etc.) from unknown sources and/or found with binary contents.
Block the IP, URLs, file hashes that have identified in connection with the campaigns and spreading malware. Please refer the attachment IOCs – Locky Ransomware.xlsx for details.

Control over Application windows 10

Today ZERODIUM hosts Tor Browser Zero-Day Bounty and it is offering $1,000,000 for Zero-day exploits with Tor on Linux and Windows.And the bug bounty program is open up to November 30th, 2017 at 6:00 pm EDT and may be it closed in prior if the total payout reaches $1,000,000.

Submission Process

ZERODIUM Payouts

In 2013 it was around 205,000, it increased in 2014 by 701,000 and in 2017 a dramatic increase within the first eight months it reached 1.65 million.

Exploiting Methods Cryptocurrency Malware Miners

The United States, United Kingdom, and Canada made up the bulk of the target regions, with the US taking up 58% of all our detected infections, while Great Britain and Canada were at 12% and 8% respectively.

How Does EMOTET Stealing the Personal Information

If EMOTET has no admin privileges, it will drop the copies into %AppDataLocal%\Microsoft\Windows\{string 1}{string 2}.exe

If EMOTET contains admin privileges, it will instead drop the copies into System%\{string 1}{string 2}.exe

The worst part of the attacks is that user not required to set in discoverable mode or to be paired with attackers device and later not required to Authorize the connection.

Security patches

Defences

This means that Bashware may potentially affect any of the 400 million computers currently running Windows 10 PC globally.

How Does it Bypass the security Futures

According to Checkpoint Software, a hybrid concept which allows a combination of Linux and Windows systems to run at the same time but allow them to use the features provided by WSL to hide from security products that have not yet integrated the proper detection mechanisms

“A360 is a cloud-based workspace that centralizes, connects and organizes your team and project information across your desktop, the web, and mobile devices.”A360 Drive provides online storage for collaboration. Anyone can create an account for free and given 5GB of space.

Also Read: Free Remote Access Trojan builder “Cobian RAT” Distributed a Backdoor

How Does These RAT’s Abusing the Cloud Infrastructure

Macro File is Encrypted and also Obfusticated Exicutable that will be finally Decrypted.it contains a payloadthat is a malicious PowerShell script that will download a file from A360 Drive and execute it.

A Free Remote Access Trojan Builder called “Cobian RAT” Distributed with embedded Backdoor and it it was being offered for free and had a lot of similarities to the njRAT/H-Worm family.

Also Read: AndroidRat-TheFatRat to Hack and Gain access to Targeted Android Phone

How Does Cobian RAT Works

This allows the original author to control the systems infected by the malware payloads that were generated using this backdoored builder kit.

During Zscaler analysis, we observed that when the machine name and username of the systems running the Cobian RAT payload (bot client) and the control server (bot C&C server) are the same, the backdoor module will not be activated and no communication will be sent to the backdoor C&C server.

Vulnerability on Android OS

The analysis of the thousands of emails sent in the campaign revealed this attack data: 11,625 different IP addresses in 133 different countries are being used to perform this campaign and also Spreading via spoofing Dropbox.

Key Attributes of Locky Ransomware

While some of the campaigns were also seen spreading with a ZIP attachment that contains a Visual Basic Script (VBS) file that is nested inside a secondary ZIP file.

Once clicked, VBS file initiates a downloader that reaches out to the malicious domain to pull down the latest Locky ransomware.

Detection Tips

Prevention Tips