LTS Secure Warning: NEW SDBbot RAT Being Distributed Via GET2 Downloader

Researchers have observed cybercrime group ‘TA505’, using a new RAT dubbed SDBbot, being delivered via GET2 downloader in recent attacks. The G2 downloader has been previously used in various campaigns to deliver secondary payloads, including Snatch ransomware, FlawedGrace & Flawed Ammyy Rats. SDBbot is written in C++ and makes use of application shimming in order to maintain persistence.   Technical Details
  • The group has developed the new Get2 loader to work in conjunction with Excel macro.
  • Get2 is being embedded into the excel file as an image.
  • Further, a loader DLL is being utilized to execute the SDBbot payload on the victim machine.
  • Researchers have also observed ‘TA505’ distributing malspam emails with URL shortener links to redirect victims to landing page, that turn links to an Microsoft excel file.
  Impact
  • Take screenshots of desktop.
  • Records videos & takes pictures from webcam.
  • Disk & system information enumeration along with directory listing.
  • Can find, read, write, delete, and copy files.
  • Spawn command-line shells.
  Recommended Actions
  • Implement Principle of least privilege.
  • Always update your anti-virus software with the latest releases.
  • Periodically run “full system scan” on your endpoints.
  • Make proper security configuration for Firewall/IDS/IPS/Endpoint Protection systems so that no holes are left barred.
  • Isolate all of the compromised computers ASAP to prevent threats from spreading further inside your infrastructure.
 
LTS Secure Locations
  • Florida: 407-965-5509
    Los Angeles: 323-544-5013
    Mid West: 800 689 4506

  • Chicago/Midwest– 2406 Schumacher Drive, Mishawaka, IN, 46545

    201, Tower S4, Phase II, Cybercity, Magarpatta Township, Hadapsar, Pune-411013