Categories: Backdoor

Free Remote Access Trojan builder “Cobian RAT” Distributed a Backdoor

A Free Remote Access Trojan Builder called “Cobian RAT” Distributed with embedded Backdoor and it it was being offered for free and had a lot of similarities to the njRAT/H-Worm family.

This RAT was Distributing and advertising via some Secret and Darkweb Forums where cyber criminal selling and Buying advance Hacking tools.

This RAT has many similar activities same as njRAT/H-Worm family which is offering for free of cost.

This Backdoored RAT contains Many Advance Futures such as Keylogger, screen capture, webcam, voice Recorder, File Browser, Remote Command Shell and install/uninstall Future.

Also Read: AndroidRat-TheFatRat to Hack and Gain access to Targeted Android Phone

How Does Cobian RAT Works

Initially, Cabian RAT Distributing through online Forums that contains hidden Backdoor that is controlling by the Original Author.

Next Level, RAT Payloads are generated by Builder Kits that is Distributing via Traditional Methods such as Email and Compromised Websites.

 Cobian RAT command-and-control server application

Here Pastebin URL used by the Malware author that helps to Pull the information from the Author.

Later, User systems Compromised by the Malicious payload and information will send to the Malware author’s Command & Control Server.

This allows the original author to control the systems infected by the malware payloads that were generated using this backdoored builder kit.

In this case, Malware Author can able to take the full control of the systems that was compromised by the  Cobian RAT botnets.

According to Zscaler Analysis, Cobian RAT spreding Via Microsoft Excel spreadsheet using an embedded icon and executable payload was served inside a ZIP archive.

“The executable file is packed using a .NET packer with the encrypted Cobian RAT payload embedded in the resource section. There is a series of anti-debugging checks performed by this dropper payload before decrypting the RAT and installing it on the victim’s system.”

This same RAT used to Compromise the Zscalar Cloud Sandbox from a Pakistan-based defense and telecommunication solution website.

During Zscaler analysis, we observed that when the machine name and username of the systems running the Cobian RAT payload (bot client) and the control server (bot C&C server) are the same, the backdoor module will not be activated and no communication will be sent to the backdoor C&C server.

Second Level Operator using both bot client and server applications in the same system that will lead to hiding the Payload and there will be no traffic generated from the bot client to the backdoor C&C server in this case.Zscaler Said.

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS devices.…

2 days ago

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch Experts…

3 days ago

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan exploits…

4 days ago

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on organizations…

4 days ago

Google Chrome Security, Critical Vulnerabilities Patched

Google has updated its Chrome browser, addressing critical vulnerabilities that posed potential risks to millions…

4 days ago

Notorious WrnRAT Delivered Mimic As Gambling Games

WrnRAT is a new malware attack that cybercriminals have deployed by using popular gambling games…

4 days ago