Categories: Backdoor

Free Remote Access Trojan builder “Cobian RAT” Distributed a Backdoor

A Free Remote Access Trojan Builder called “Cobian RAT” Distributed with embedded Backdoor and it it was being offered for free and had a lot of similarities to the njRAT/H-Worm family.

This RAT was Distributing and advertising via some Secret and Darkweb Forums where cyber criminal selling and Buying advance Hacking tools.

This RAT has many similar activities same as njRAT/H-Worm family which is offering for free of cost.

This Backdoored RAT contains Many Advance Futures such as Keylogger, screen capture, webcam, voice Recorder, File Browser, Remote Command Shell and install/uninstall Future.

Also Read: AndroidRat-TheFatRat to Hack and Gain access to Targeted Android Phone

How Does Cobian RAT Works

Initially, Cabian RAT Distributing through online Forums that contains hidden Backdoor that is controlling by the Original Author.

Next Level, RAT Payloads are generated by Builder Kits that is Distributing via Traditional Methods such as Email and Compromised Websites.

 Cobian RAT command-and-control server application

Here Pastebin URL used by the Malware author that helps to Pull the information from the Author.

Later, User systems Compromised by the Malicious payload and information will send to the Malware author’s Command & Control Server.

This allows the original author to control the systems infected by the malware payloads that were generated using this backdoored builder kit.

In this case, Malware Author can able to take the full control of the systems that was compromised by the  Cobian RAT botnets.

According to Zscaler Analysis, Cobian RAT spreding Via Microsoft Excel spreadsheet using an embedded icon and executable payload was served inside a ZIP archive.

“The executable file is packed using a .NET packer with the encrypted Cobian RAT payload embedded in the resource section. There is a series of anti-debugging checks performed by this dropper payload before decrypting the RAT and installing it on the victim’s system.”

This same RAT used to Compromise the Zscalar Cloud Sandbox from a Pakistan-based defense and telecommunication solution website.

During Zscaler analysis, we observed that when the machine name and username of the systems running the Cobian RAT payload (bot client) and the control server (bot C&C server) are the same, the backdoor module will not be activated and no communication will be sent to the backdoor C&C server.

Second Level Operator using both bot client and server applications in the same system that will lead to hiding the Payload and there will be no traffic generated from the bot client to the backdoor C&C server in this case.Zscaler Said.

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

Dell Wyse Management Suite Vulnerabilities Let Attackers Exploit Affected Systems Remotely

Dell Technologies has released a security update for its Wyse Management Suite (WMS) to address…

8 minutes ago

CISA Details Red Team Assessment Including TTPs & Network Defense

The Cybersecurity and Infrastructure Security Agency (CISA) recently detailed findings from a Red Team Assessment…

17 minutes ago

IBM Workload Scheduler Vulnerability Stores User Credentials in Plain Text

IBM has issued a security bulletin warning customers about a vulnerability in its Workload Scheduler…

41 minutes ago

Multiple Flaws With Android & Google Pixel Devices Let Attackers Elevate Privileges

Several high-severity vulnerabilities have been identified in Android and Google Pixel devices, exposing millions of…

55 minutes ago

Threat Actors Exploit Google Docs And Weebly Services For Malware Attacks

Phishing attackers used Google Docs to deliver malicious links, bypassing security measures and redirecting victims…

17 hours ago

Python NodeStealer: Targeting Facebook Business Accounts to Harvest Login Credentials

The Python-based NodeStealer, a sophisticated info-stealer, has evolved to target new information and employ advanced…

17 hours ago