New Malware Builder Makes Hacking Easier

A free new builder for trojans makes it easier than ever to be a criminal hacker.

It's never been easier to be a hacker. That's the latest takeaway from a blog post by Zscalar in which they detail a free program for building dangerous malware.

The particular malware being offered, known as Cobian RAT (remote access trojan), has been in the wild since the beginning of 2017. RAT builders are frequently offered for sale on criminal hacker web sites, but this version is notable because it's free.

Of course, there is a price to be paid, and in this case the price is a backdoor that allows the newly built malware to be controlled by the original malware's author -- something that isn't made clear in the documentation and is hidden when the malware is executed in most testing environments.

In some critical ways this is the criminal malware version of multi-level marketing, in which the original malware's author is depending on down-stream builders to spread the malware far and wide, after which it can be activated and controlled by the originator.

According to the Xscaler researchers, the code used in the Cobian RAT is similar to that used in earlier NjRAT and H-Worm variants first seen more than four years ago. The original malware was common in the Middle East and that seems to be the center of Cobian RAT activity as well.

You're invited to attend Light Reading's Virtualizing the Cable Architecture event – a free breakfast panel at SCTE/ISBE's Cable-Tec Expo on October 18 featuring Comcast's Rob Howald and Charter's John Dickinson.

What sort of activity does the Cobian RAT initiate? Among the features of software are keylogger, screen capture, webcam, voice recorder and file browser functions, along with the ability to install and uninstall applications and dynamic plugins. An infected user could literally have every action they take on the computer (or in the same room as the computer) captured and downloaded to the controlling server.

The widespread nature of the original malware and the multi-level marketing aspect of the new variant together create the potential for a massive botnet that could be used to generate spam or record-breaking DDoS attacks. As always, individuals and companies should be vigilant for .ZIP and other packed files sent from suspicious addresses or in uncommon circumstances from known -- and possibly spoofed -- contacts.

Related posts:

— Curtis Franklin is the editor of SecurityNow.com. Follow him on Twitter @kg4gwa.

Read more about:

Security Now

About the Author

Curtis Franklin, Principal Analyst, Omdia

Curtis Franklin Jr. is Principal Analyst at Omdia, focusing on enterprise security management. Previously, he was senior editor of Dark Reading, editor of Light Reading's Security Now, and executive editor, technology, at InformationWeek, where he was also executive producer of InformationWeek's online radio and podcast episodes

Curtis has been writing about technologies and products in computing and networking since the early 1980s. He has been on staff and contributed to technology-industry publications including BYTE, ComputerWorld, CEO, Enterprise Efficiency, ChannelWeb, Network Computing, InfoWorld, PCWorld, Dark Reading, and ITWorld.com on subjects ranging from mobile enterprise computing to enterprise security and wireless networking.

Curtis is the author of thousands of articles, the co-author of five books, and has been a frequent speaker at computer and networking industry conferences across North America and Europe. His most recent books, Cloud Computing: Technologies and Strategies of the Ubiquitous Data Center, and Securing the Cloud: Security Strategies for the Ubiquitous Data Center, with co-author Brian Chee, are published by Taylor and Francis.

When he's not writing, Curtis is a painter, photographer, cook, and multi-instrumentalist musician. He is active in running, amateur radio (KG4GWA), the MakerFX maker space in Orlando, FL, and is a certified Florida Master Naturalist.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights