Article Details
Scrape Timestamp (UTC): 2024-01-05 05:20:58.560
Source: https://thehackernews.com/2024/01/new-bandook-rat-variant-resurfaces.html
Original Article Text
Click to Toggle View
New Bandook RAT Variant Resurfaces, Targeting Windows Machines. A new variant of remote access trojan called Bandook has been observed being propagated via phishing attacks with an aim to infiltrate Windows machines, underscoring the continuous evolution of the malware. Fortinet FortiGuard Labs, which identified the activity in October 2023, said the malware is distributed via a PDF file that embeds a link to a password-protected .7z archive. "After the victim extracts the malware with the password in the PDF file, the malware injects its payload into msinfo32.exe," security researcher Pei Han Liao said. Bandook, first detected in 2007, is an off-the-shelf malware that comes with a wide range of features to remotely gain control of the infected systems. In July 2021, Slovak cybersecurity firm ESET detailed a cyber espionage campaign that leveraged an upgraded variant of Bandook to breach corporate networks in Spanish-speaking countries such as Venezuela. The starting point of the latest attack sequence is an injector component that's designed to decrypt and load the payload into msinfo32.exe, a legitimate Windows binary that gathers system information to diagnose computer issues. The malware, besides making Windows Registry changes to establish persistence on the compromised host, establishes contact with a command-and-control (C2) server to retrieve additional payloads and instructions. "These actions can be roughly categorized as file manipulation, registry manipulation, download, information stealing, file execution, invocation of functions in DLLs from the C2, controlling the victim's computer, process killing, and uninstalling the malware," Han Liao said.
Daily Brief Summary
A new variant of the Bandook Remote Access Trojan (RAT) has been identified targeting Windows machines through phishing campaigns.
Fortinet FortiGuard Labs reported the malware's distribution method: a phishing email containing a PDF file that leads to a password-protected .7z archive.
Upon opening the archive using the password from the PDF, the Bandook malware injects its payload into the legitimate Windows system file msinfo32.exe.
Originally detected in 2007, Bandook is a commercial malware that provides attackers with extensive remote control capabilities over infected systems.
The latest version of Bandook has been implicated in a cyber espionage campaign, according to research from ESET in 2021, with attacks focusing on Spanish-speaking countries.
Once installed, the malware alters Windows Registry settings for persistence and connects to a command-and-control server for further malicious instructions and payload downloads.
The abilities of this RAT include file and registry manipulation, data theft, downloading additional payloads, executing files, and even uninstalling itself remotely.