Το κακόβουλο λογισμικό BIOPASS χρησιμοποιεί λογισμικό ροής OBS Studio για την εγγραφή οθονών θυμάτων

Helga SmithΙούλιος 13, 2021Τελευταία ενημέρωση: Ιούλιος 13, 2021

247 1 λεπτό διάβασμα

Trend Micro έχει ανακαλύψει BIOPASS malware that attacks and spies on users of Chinese gambling sites. The researchers speculate that the well-known spy hack group Winnti (APT41) may be behind the creation of this malware.

BIOPASS is a Remote Access Trojan (ΑΡΟΥΡΑΙΟΣ) written in Python. Τυπικά, it hides inside the legitimate installers of Adobe Flash Player or Microsoft Silverlight, which are still in use in China, even though they are no longer supported in the rest of the world.

Experts write that malicious JavaScript is used to spread the malware, which is hosted on technical support or chat pages of Chinese gambling sites. It redirects users to pages that offer infected installers to potential victims. If a user fell for this trick of cybercriminals, BIOPASS penetrated his system.

Κακόβουλο λογισμικό BIOPASS

Malware differs little from other RATs and has such features as file system evaluation, remote desktop access, file stealing and shell-command execution. The malware can also compromise the personal information of victims by stealing data from browsers and instant messengers (including QQ Browser, 2345 Explorer, Sogou Explorer and 360 Safe Browser, WeChat, QQ and Aliwangwang).

An interesting feature of this malware is the use of the popular streamer software OBS Studio, which is often used by users of Twitch, YouTube, και ούτω καθεξής. The attackers used RTMP in OBS Studio to capture the user’s screen and broadcast video directly to the malware control panel.

We consider BIOPASS RAT as still being actively developed. Για παράδειγμα, some markers that we discovered during our analysis refer to different versions of RAT code, such as “V2” or “BPSV3”. Many of the loaders that we found were used to load Cobalt Strike shellcode by default instead of the BIOPASS RAT malware. Furthermore, BIOPASS RAT also creates scheduled tasks to load the Cobalt Strike shellcode during the initialization, indicating that the malicious actor behind the attack still heavily relies on Cobalt Strike.Trend Micro experts write.

Με ενδιαφέρο, the Winnti group, which is allegedly responsible for creating the malware, is known as a Chinese cyber espionage group. Sometimes, with the aim of gaining personal gain, Winnti arranges attacks on gambling companies in Southeast Asia. Since in this case the attacks are targeting Chinese users, the researchers are not too sure about their attribution.

Επιτρέψτε μου να σας υπενθυμίσω ότι το έγραψα και αυτό Κινέζοι χάκερ καλύπτουν τα ίχνη τους και αφαιρούν κακόβουλο λογισμικό λίγες μέρες πριν τον εντοπισμό.

Ετικέτες