Hackers Deploy Modular RAT With Credential Theft and Screenshot Capture Capabilities

The post discusses the deployment of a modular Remote Access Trojan (RAT) by hackers, which is designed to steal credentials and capture screenshots. Here are the key points:

1. Campaign Overview:

   • The malware campaign targets organizations in Southeast Asia.
   • It uses various lures such as fake documents related to whistleblowing reports or national IDs.

2. Malware Components:

   • LNK Dropper: Lure files that drop additional payloads when executed.
   • Multi-Stage Shellcode Loader (360.8.dll): Loads and executes the main payload.
   • Malicious Executable (th5znehec.exe): Contains the core RAT functionality.
   • DLL Component (a.dll): Additional malicious code that supports the RAT.

3. Indicators of Compromise (IoCs):

   • File hashes for various components of the malware.
   • C2 domain (whatsappcenter[.]com).
   • IP address (38[.]54[.]122[.]188) associated with bulletproof hosting infrastructure.

4. Mitigation and Detection:

   • Organizations should monitor for suspicious LNK files,

Read the full article at Cyber Security News

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.