Batu69 Posted November 26, 2016 Share Posted November 26, 2016 Website spreading Gatak-infected keygens (via Symantec) Websites offering free keygens for various enterprise software applications are helping crooks spread the Gatak malware, which opens backdoors on infected computers and facilitates attacks on a company's internal network, or the theft of sensitive information. Gatak is a backdoor trojan that first appeared in 2012. Another name for this threat is Stegoloader, and its main distinctive feature is its ability to communicate with its C&C servers via steganography. Gatak relies on steganography to stain hidden Steganography is the technique of hiding data in plain sight. In the world of cyber-security, steganography is the practice of hiding malicious code, commands, or malware configuration data inside PNG or JPG images. The malware, in this case Gatak, connects to its online C&C server and requests new commands. Instead of receiving an HTTP network requests, for which all security software knows to be on the lookout, the data is sent as an innocuous image, which looks like regular web traffic. The malware reads the image's hidden data and executes the command, all while the local antivirus thinks the user has downloaded an image off the Internet. Keygens for enterprise software spreading Gatak Security firm Symantec says it uncovered a malware distribution campaign that leverages a website offering free keygens for various applications such as: SketchList3D - woodworking design software Native Instruments Drumlab - sound engineering software BobCAD-CAM - metalworking/manufacturing software BarTender Enterprise Automation - label and barcode creation software HDClone - hard disk cloning utility Siemens SIMATIC STEP 7 - industrial automation software CadSoft Eagle Professional - printed circuit board design software PremiumSoft Navicat Premium - database administration software Originlab Originpro - data analysis and graphing software Manctl Skanect - 3D scanning software Symantec System Recovery - backup and data recovery software All of the above are specialized apps, deployed in enterprise environments. The group behind this campaign is specifically targeting users that use these applications at work, but without valid licenses, in the hopes of infecting valuable targets they could hack, steal data from, and possibly sell it on the underground. Keygens don't work, they just infect users with Gatak The keygens distributed via this website aren't even fully-working tools. They just produce a random string of characters, but their purpose is to trick the user into executing the keygen binary just once, enough to infect the victim. The hackers are picky about the companies they target because the security firm has seen second-stage attacks on only 62% of all infected computers. Attackers use Gatak to gather basic information about targets, on which, if they deem valuable, deploy other malware at later stages. In some cases, the hackers also resort to lateral movement on the victim's network, with the attackers manually logging into the compromised PC. Attacks aren't sophisticated, and the hackers only take advantage of weak passwords inside the local network. Symantec says it didn't detect any zero-days or automated hacking tools employed when hackers have attempted to infect other devices on the local network. Gatak infections per industry vertical (via Symantec) Telemetry data shows that 62% of all Gatak infections have been found on computers on enterprise networks. Most of these attacks have targeted the healthcare sector, but it doesn't appear that hackers specifically targeted this industry vertical, as other companies in other verticals were also hit. Attackers might have opted to focus more on healthcare institutions because these organizations usually store more in-depth user data they can steal, compared to the automotive industry, gambling, education, construction, or others. "In some cases, the attackers have infected computers with other malware, including various ransomware variants and the Shylock financial Trojan," Symantec notes in a report. "They may be used by the group when they believe their attack has been uncovered, in order to throw investigators off the scent." Article source Link to comment Share on other sites More sharing options...
steven36 Posted November 26, 2016 Share Posted November 26, 2016 most antvirus will detect it i'm not shocked that enterprises are catching it too cheap to buy software and too cheap to get a antivirus https://www.virustotal.com/en/file/da2722e1ef5350c45550b5590affbe48675b63f724701ce18b215ff8127d4588/analysis/ https://www.virustotal.com/en/file/cd6a915c7f29513218f2beadb5d7f9cc8b39d54d6e9f994f609eb30055792de7/analysis/ Remove Trojan:Win32/Gatak (Virus Removal Guide) https://malwaretips.com/blogs/trojan-win32-gatak-removal/ only keygen sites you can trust really is web distro because many have always put malware in there packs for as long as i remember now they have fake cracks witch is even worse . From FFF NFO Special note: ³ ÛÛ² ²ÛÛ ³ ³ ÛÛ² ²ÛÛ ³ On some antivirus scans, FFF releases packages can reveal ³ ÛÛ² ²ÛÛ ³ "Type_Win32" or "Trojan_Type" virus... ³ ÛÛ² ²ÛÛ ³ Don't be stupid! It is not a virus nor anything else like ³ ÛÛ² ²ÛÛ ³ that. It is just some packers/cryptors which have the ³ ÛÛ² ²ÛÛ ³ same binary signature. ³ ÛÛ² ²ÛÛ ³ ³ ÛÛ² ²ÛÛ ³ However, some crackhosts can modify or add malicious ³ ÛÛ² ²ÛÛ ³ things on FFF releases (like "crack.exe"), so please, ³ ÛÛ² ²ÛÛ ³ TAKE CARE. ³ ÛÛ² ²ÛÛ ³ Link to comment Share on other sites More sharing options...
UnknownOne Posted November 26, 2016 Share Posted November 26, 2016 This is usually why checking md5 or sha1 hash signature is always recommended.. or just get from original source.. Link to comment Share on other sites More sharing options...
banned Posted November 28, 2016 Share Posted November 28, 2016 I guess they haven't updated to the current version of Windows where no one needs to worry about malware anymore Link to comment Share on other sites More sharing options...
UnknownOne Posted November 28, 2016 Share Posted November 28, 2016 windows 10 is an insecure piece of shit.. so is windows 8.1.. 'abusing of protocols to bypass html5' haven't even scratched the surface with all the other lovely bugs.. plenty of poc's out there.. read: that.. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.