Złośliwe oprogramowanie BIOPASS wykorzystuje oprogramowanie do przesyłania strumieniowego OBS Studio do nagrywania ekranów ofiar

Helga Smithlipiec 13, 2021Ostatnio zaktualizowany: lipiec 13, 2021

247 1 minuta przeczytania

Trend Micro odkrył BIOPASS malware that attacks and spies on users of Chinese gambling sites. The researchers speculate that the well-known spy hack group Winnti (APT41) may be behind the creation of this malware.

BIOPASS is a Remote Access Trojan (SZCZUR) written in Python. zazwyczaj, it hides inside the legitimate installers of Adobe Flash Player or Microsoft Silverlight, which are still in use in China, even though they are no longer supported in the rest of the world.

Experts write that malicious JavaScript is used to spread the malware, which is hosted on technical support or chat pages of Chinese gambling sites. It redirects users to pages that offer infected installers to potential victims. If a user fell for this trick of cybercriminals, BIOPASS penetrated his system.

Złośliwe oprogramowanie BIOPASS

Malware differs little from other RATs and has such features as file system evaluation, remote desktop access, file stealing and shell-command execution. The malware can also compromise the personal information of victims by stealing data from browsers and instant messengers (including QQ Browser, 2345 Explorer, Sogou Explorer and 360 Safe Browser, WeChat, QQ and Aliwangwang).

An interesting feature of this malware is the use of the popular streamer software OBS Studio, which is often used by users of Twitch, YouTube, i tak dalej. The attackers used RTMP in OBS Studio to capture the user’s screen and broadcast video directly to the malware control panel.

We consider BIOPASS RAT as still being actively developed. Na przykład, some markers that we discovered during our analysis refer to different versions of RAT code, such as “V2” or “BPSV3”. Many of the loaders that we found were used to load Cobalt Strike shellcode by default instead of the BIOPASS RAT malware. Ponadto, BIOPASS RAT also creates scheduled tasks to load the Cobalt Strike shellcode during the initialization, indicating that the malicious actor behind the attack still heavily relies on Cobalt Strike.Trend Micro experts write.

co ciekawe, the Winnti group, which is allegedly responsible for creating the malware, is known as a Chinese cyber espionage group. Czasami, with the aim of gaining personal gain, Winnti arranges attacks on gambling companies in Southeast Asia. Since in this case the attacks are targeting Chinese users, the researchers are not too sure about their attribution.

Przypomnę, że ja też tak napisałem Chińscy hakerzy zacierają ślady i usuwają złośliwe oprogramowanie na kilka dni przed wykryciem.

Tagi