DarkComer RAT disguised as Skype encryption software
Posted on 20.04.2012
Bookmark and Share
A while ago, Syrian dissidents claimed that the government uses malware to spy on them.

The malware was delivered through compromised email accounts of other opposition members, or via online chats that they believe they are having with a fellow dissident, but are actually having with a government agent who hijacked the account.

Now Trend Micro researchers have discovered another way that the Syrian government tries to install backdoors into its opponents' computers.

"We discovered a webpage that advertises a software that purports to provide encryption for Skype," say the researchers. "This page is hosted in Syria on {BLOCKED}encription.sytes.net, which resolves to {BLOCKED}.{BLOCKED}.0.28 - the same server that acted as a command-and-control server for previous attacks. The webpage features an embedded YouTube video that claims to be from 'IT Security Lab' and to encrypt voice communications."

When downloaded and run, the offered software looks pretty legitimate - even though the version stated on the software does not correspond with the one stated in the offered file (Skype Encription v 2.1.exe):


Unfortunately for those who did so, the software is actually a backdoor Trojan that immediately contacts the aforementioned C&C server and downloads the DarkComet RAT, whose capabilities include keystroke logging, file system access and remote control, and control of devices such as microphones and webcams






Spotlight

Attackers use reflection techniques for larger DDoS attacks

Posted on 17 April 2014.  |  Instead of using a network of zombie computers, newer DDoS toolkits abuse Internet protocols that are available on open or vulnerable servers and devices. This approach can lead to the Internet becoming a ready-to-use botnet for malicious actors.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Apr 18th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //