ZenRAT Malware Distributed by Spoofing Legitimate App
A new type of malicious software known as ZenRAT has surfaced in the wild. It is distributed through deceptive installation packages that mimic a legitimate password manager application.
Enterprise security firm Proofpoint has reported that ZenRAT specifically targets Windows users and redirects users on other operating systems to harmless web pages. This malware is a modular remote access trojan (RAT) capable of stealing information.
ZenRAT is found on counterfeit websites pretending to be affiliated with the genuine app. The means by which traffic is directed to these domains is unclear. In the past, similar malware has been spread through methods like phishing, malvertising, or SEO poisoning attacks.
The payload, which can be downloaded from crazygameis[.]com, is a tampered version of the standard app installation package, containing a malicious .NET executable called ApplicationRuntimeMonitor.exe.
An interesting aspect of this campaign is that non-Windows users who visit the deceptive website are redirected to a cloned article from opensource.com published in March 2018 about managing passwords using legitimate tools. Meanwhile, Windows users who click on download links labeled for Linux or macOS on the Downloads page are directed to the legitimate app's site.
ZenRAT Attempts to Disguise Itself
An examination of the installer's metadata shows that the threat actor attempted to disguise the malware as Speccy, a free Windows utility for displaying hardware and software information.
The digital signature used to sign the executable is not only invalid but also falsely claims to be signed by Tim Kosse, a well-known German computer scientist known for creating the free cross-platform FTP software FileZilla.
Upon launching, ZenRAT collects information about the host, including CPU and GPU details, the operating system version, browser credentials, installed applications, and security software. This information is sent to a command-and-control (C2) server (185.186.72[.]14) operated by the threat actors.
Proofpoint explains that the client initiates communication with the C2 server, and the first packet sent is consistently 73 bytes in size. ZenRAT is configured to transmit its logs to the server in plain text, which captures various system checks performed by the malware and the status of each module's execution. This highlights its functionality as a "modular, expandable implant."
