Alert! New Borat Remote Access Malware

Recently, a new Remote Access Trojan (RAT) named Borat has appeared on dark net markets, offering easy-to-use features that can conduct DDoS attacks, UAC bypass, and ransomware deployment.

As a RAT, Borat enables remote attackers to gain complete control over a victim's mouse and keyboard, access files, network connections, and hide their tracks.

The malware allows its attackers to select their compilation options to create small payloads and utilize these payloads for highly customized attacks.

Researchers at Cyble sampled and studied Borat to analyze its capabilities.

Some functions of Borat

▌Extensive Capabilities

It remains unclear whether Borat RAT is being sold or shared for free among cybercriminals, but Cyble indicates that it comes in the form of a package containing a builder, malware modules, and server certificates.

Files in the Borat RAT archive

Each function of the Trojan has its own dedicated module, including the following:

• Keylogging: Monitors and records keystrokes, and stores them in txt files

• Ransomware: Deploys a ransomware payload onto the victim's machine and automatically generates a ransom note through Borat

• DDoS: Uses the resources of infected machines to direct junk traffic to the target server

• Audio Recording: Records audio via microphone and stores it in wav files

• Webcam Recording: Records video from the webcam

• Remote Desktop: Launches a hidden remote desktop to perform file operations, use input devices, execute code, launch applications, etc.

• Reverse Proxy: Sets up a reverse proxy to protect the remote attacker's identity from exposure

• Device Info: Gathers basic system information

• Process Hollowing: Injects malware code into legitimate processes to evade detection

• Credential Stealing: Steals account credentials stored in Chromium-based web browsers

• Discord Token Stealing: Steals Discord tokens from the victim

• Other Features: Disturbs and confuses the victim by playing audio, swapping mouse buttons, hiding the desktop, hiding the taskbar, holding down the mouse, turning off the monitor, showing a blank screen, or hanging the system

  

More of Borat's advertised features

As Cyble's analysis shows, Borat is essentially a RAT, spyware, and ransomware that can carry out various malicious activities on a device, requiring high vigilance.

All in all, even though the developers of the RAT decided to name it after the protagonist of the comedy movie Borat, the malware cannot truly be taken lightly as a joke.

Bleeping Computer dug deeper trying to find the origin of the malware and found that the payload executable was recently identified as AsyncRAT.

Attackers usually spread these tools disguised as additional executables or files for game and application cracks, so please be careful not to download anything from unreliable sources, such as torrents or the dark web.

Of course, relying solely on subjective vigilance makes it hard to guard effectively, so enterprises may rely more on their own established defense systems.

So the real question enterprises need to consider is, can their own defense system withstand these constantly emerging new types of malware?

Pyramid Verification gathers an outstanding security analysis team in the industry to answer this question for customers. Pyramid Security Lab tracks internet hacker groups and vulnerabilities 24/7, using first-hand intelligence obtained to timely recreate attack techniques, allowing customers to use these real attack scenarios to verify the effectiveness of their defense systems.

The Pyramid Security Metric Verification Platform is a security monitoring platform that can continuously test, measure, and improve network security efficiency. At the same time, it provides measurement tools for the IT environment to conduct repeatable, continuous, end-to-end testing against real attacks, thereby verifying that deployed security measures are working as expected, and proactively discovering the impact of changes in the environment to issue alerts.

| Reference Source:

https://www.bleepingcomputer.com/news/security/new-borat-remote-access-malware-is-no-laughing-matter/