DarkComer RAT disguised as Skype encryption software
Posted on 20.04.2012
A while ago, Syrian dissidents claimed that the government uses malware to spy on them.

The malware was delivered through compromised email accounts of other opposition members, or via online chats that they believe they are having with a fellow dissident, but are actually having with a government agent who hijacked the account.

Now Trend Micro researchers have discovered another way that the Syrian government tries to install backdoors into its opponents' computers.

"We discovered a webpage that advertises a software that purports to provide encryption for Skype," say the researchers. "This page is hosted in Syria on {BLOCKED}encription.sytes.net, which resolves to {BLOCKED}.{BLOCKED}.0.28 - the same server that acted as a command-and-control server for previous attacks. The webpage features an embedded YouTube video that claims to be from 'IT Security Lab' and to encrypt voice communications."

When downloaded and run, the offered software looks pretty legitimate - even though the version stated on the software does not correspond with the one stated in the offered file (Skype Encription v 2.1.exe):


Unfortunately for those who did so, the software is actually a backdoor Trojan that immediately contacts the aforementioned C&C server and downloads the DarkComet RAT, whose capabilities include keystroke logging, file system access and remote control, and control of devices such as microphones and webcams






Spotlight

The security threat of unsanctioned file sharing

Posted on 31 October 2014.  |  Organisational leadership is failing to respond to the escalating risk of ungoverned file sharing practices among their employees, and employees routinely breach IT policies.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Oct 31st
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //