DarkComer RAT disguised as Skype encryption software
Posted on 20.04.2012
A while ago, Syrian dissidents claimed that the government uses malware to spy on them.

The malware was delivered through compromised email accounts of other opposition members, or via online chats that they believe they are having with a fellow dissident, but are actually having with a government agent who hijacked the account.

Now Trend Micro researchers have discovered another way that the Syrian government tries to install backdoors into its opponents' computers.

"We discovered a webpage that advertises a software that purports to provide encryption for Skype," say the researchers. "This page is hosted in Syria on {BLOCKED}encription.sytes.net, which resolves to {BLOCKED}.{BLOCKED}.0.28 - the same server that acted as a command-and-control server for previous attacks. The webpage features an embedded YouTube video that claims to be from 'IT Security Lab' and to encrypt voice communications."

When downloaded and run, the offered software looks pretty legitimate - even though the version stated on the software does not correspond with the one stated in the offered file (Skype Encription v 2.1.exe):

Unfortunately for those who did so, the software is actually a backdoor Trojan that immediately contacts the aforementioned C&C server and downloads the DarkComet RAT, whose capabilities include keystroke logging, file system access and remote control, and control of devices such as microphones and webcams


Harnessing artificial intelligence to build an army of virtual analysts

PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Thu, Feb 4th