New 'Borat' Remote Access Trojan Includes Ransomware Capabilities
Security researchers have singled out yet another nasty threat that is sure to make waves in the infosec landscape in the coming months. The new malware is called Borat RAT, but unlike Sacha Baron Cohen's quirky character, it isn't entertaining in the least.
Borat RAT is not a simple remote access trojan or RAT. The malware is a Swiss knife of a toolkit, combining the functionality of a RAT with spying and ransomware capabilities.
Borat RAT definitely not a joke
As is customary for a lot of new malware toolkits, the Borat RAT is sold on the dark web, using hacker forums to advertise itself.
The full lineup of Borat RAT's functionality is a little scary. The malware includes a ransomware module, a keylogger, and a distributed denial of service (DDoS) module. Spying capabilities include audio capture using the compromised system's microphone and capturing video from a connected webcam. Borat RAT can also grab screenshots, take control of the victim's mouse and keyboard and delete files on the host system. The examination of the malware's payload and abilities comes courtesy of the cybersecurity team with Cyble Research Labs.
In order to dodge automated security, Borat RAT uses what is referred to as "process hollowing". This means the malware compromises a legitimate process that will not trip up security and executes malicious code using the "hollowed" process memory space.
Ransomware coupled with pranks
To top it all off, the malware can also scrape browser data including history, cookies, and login credentials. Whatever is found and scraped is exfiltrated to the command and control server. The authors of the malicious toolkit also like to have a bit of fun, it seems, as Borat RAT can even pull off practical jokes on the victim, including playing audio samples, swapping left and right mouse button functionality or turning the monitor off.
While those playful features may make Borat RAT seem like a playful toy in the hands of hackers, its ransomware capabilities make it a threat to look out for. The rich malicious suite offered in the same package will likely attract many hopeful hackers, so this is probably not the last we will see of this strain of malware.
