New Borat remote access malware is no laughing matter

[LASER_oneXM]

Content source

https://www.bleepingcomputer.com/news/security/new-borat-remote-access-malware-is-no-laughing-matter/

A new remote access trojan (RAT) named Borat has appeared on darknet markets, offering easy-to-use features to conduct DDoS attacks, UAC bypass, and ransomware deployment.

As a RAT, Borat enables remote threat actors to take complete control of their victim’s mouse and keyboard, access files, network points, and hide any signs of their presence.
The malware lets its operators choose their compilation options to create small payloads that feature precisely what they need for highly tailored attacks.

Borat was analyzed by researchers at Cyble, who spotted it in the wild and sampled the malware for a technical study that revealed its functionality.

Deep Dive Analysis – Borat RAT - Cyble

Cyble Research Labs analyzes Borat , a sophisticated RAT variant that boasts a combination of Remote Access Trojan, Spyware, Ransomware and DDoS capabilities.

blog.cyble.com

 

[L0ckJaw]

Can this Borat be tested in the hub ?

 

[upnorth]

Can this Borat be tested in the hub ?

VirusTotal

VirusTotal

www.virustotal.com

F-Secure catch the .exe file ( BoratRat.exe ) on static. According to VT so is Avast, Norton. Not sure on Gdata, but I can guess it's BB would.

Then there is another problem. According to the research, one need the whole package of files for the Rat actually being able to execute/run. Or at least it's extra features.

The Borat RAT comes as a package which includes builder binary, supporting modules, server certificate, etc., as shown in Figure 4.

The figure below shows the supporting modules responsible for executing the RAT features, as shown in Figure 5.

When I tried to execute the BoratRat.exe on AnyRun it also asked for a unknown password, so this all combined makes it a no go for the Hub.