LTS Secure Warning: NEW SDBbot RAT Being Distributed Via GET2 Downloader

Researchers have observed cybercrime group ‘TA505’, using a new RAT dubbed SDBbot, being delivered via GET2 downloader in recent attacks. The G2 downloader has been previously used in various campaigns to deliver secondary payloads, including Snatch ransomware, FlawedGrace & Flawed Ammyy Rats. SDBbot is written in C++ and makes use of application shimming in order to maintain persistence.

 

Technical Details

  • The group has developed the new Get2 loader to work in conjunction with Excel macro.
  • Get2 is being embedded into the excel file as an image.
  • Further, a loader DLL is being utilized to execute the SDBbot payload on the victim machine.
  • Researchers have also observed ‘TA505’ distributing malspam emails with URL shortener links to redirect victims to landing page, that turn links to an Microsoft excel file.

 

Impact

  • Take screenshots of desktop.
  • Records videos & takes pictures from webcam.
  • Disk & system information enumeration along with directory listing.
  • Can find, read, write, delete, and copy files.
  • Spawn command-line shells.

 

Recommended Actions

  • Implement Principle of least privilege.
  • Always update your anti-virus software with the latest releases.
  • Periodically run “full system scan” on your endpoints.
  • Make proper security configuration for Firewall/IDS/IPS/Endpoint Protection systems so that no holes are left barred.
  • Isolate all of the compromised computers ASAP to prevent threats from spreading further inside your infrastructure.

 

LTS Secure Locations
  • Florida: 407-965-5509
    Los Angeles: 323-544-5013
    Mid West: 800 689 4506

  • Chicago/Midwest– 2406 Schumacher Drive, Mishawaka, IN, 46545

    201, Tower S4, Phase II, Cybercity, Magarpatta Township, Hadapsar, Pune-411013

Leave us a messages Leave us a messages

← Prev Step

Thanks for contacting us. We'll get back to you as soon as we can.

Please provide a valid name, email, and question.

Powered by LivelyChat
Powered by LivelyChat Delete History