Do Son 
At a glance
- Malware family: Abyssos
- Threat actor: Unknown
- Target or victims: Windows endpoints
- Delivery vector: Under investigation
- Key capabilities: Remote administration, hidden VNC, credential harvesting, browser hijacking
- Source: Zscaler ThreatLabz
TL;DR
Zscaler ThreatLabz recently uncovered the Abyssos modular RAT. This new C++ malware allows attackers to execute commands, steal data, and control infected endpoints. The malware developers actively update the code to evade detection and analysis.
Delivery
Currently, researchers have not confirmed the exact initial delivery vector for the Abyssos RAT. Attackers typically use phishing emails or exploit public vulnerabilities to drop this kind of malware. However, the specific entry methods for these recent campaigns remain under investigation. Security teams must monitor all standard infection routes closely. Once inside a network, the threat expands quickly. It targets Windows operating systems specifically. Therefore, administrators should remain alert to suspicious downloads and unexpected email attachments.
Infection chain
After execution, Abyssos performs a specific initialization routine. First, it dynamically resolves required Windows API functions. It iterates through the export directory of each loaded library. Then, it checks the CRC32 checksums of exported functions against expected values. Next, it creates a unique mutex to prevent multiple infections. “Abyssos creates a mutex in order to ensure that only one instance of itself is currently running.” It appends either “_Admin” or “_User” to the mutex name depending on the current user rights.
Following initialization, the malware checks the host environment. It looks for hypervisors like VMware, KVM, Xen, and VirtualBox by using the CPUID instruction. If it detects these virtualization tools, it terminates execution immediately. It also checks for specific running processes tied to analysis environments, such as vmtoolsd.exe and VBoxService.exe. Furthermore, the code uses LLVM-based obfuscators to hide its core logic. It employs control flow flattening, bogus control flow with opaque predicates, constant integer encryption, and stack-based string obfuscation.
Command-and-control and data-exfiltration behaviour
The Abyssos modular RAT uses a custom TCP protocol to communicate with its command-and-control server. It encrypts incoming and outgoing data using AES in GCM mode. This encryption process relies on a hardcoded 32-byte key. First, the malware sends host information to the server to register the compromised system. This data includes the CPU architecture, computer name, username, user integrity level, and public IP address. After registration, it sends a PING command every few seconds and waits for instructions.
The command-and-control server issues various network commands to control the host. Attackers can start a hidden VNC session to operate the desktop unseen. Within this session, they simulate mouse movements and keyboard inputs. Moreover, operators can execute shell commands remotely via the command prompt or PowerShell.
Furthermore, the malware supports modular plugins downloaded from the server. These encrypted modules extend the malware’s capabilities significantly. Specifically, they enable keylogging, cookie grabbing, Domain Controller discovery, and vulnerability scanning. One module even attempts to escalate token privileges to SYSTEM level.
One notable feature is browser session hijacking. The Abyssos RAT launches Chrome with a remote debugging port enabled. It then injects stolen cookies into the instance using the WebSocket protocol. Consequently, attackers bypass multi-factor authentication mechanisms easily. They also steal files directly using the built-in file manager commands. The malware archives targeted directories in memory before sending them to the C2 server.
Defense or detection guidance
Defenders face significant challenges tracking this Abyssos modular RAT. Its active development means static signatures change frequently. Therefore, organizations should focus on behavioral detection strategies. Analysts must monitor for unusual TCP connections to unknown external IP addresses. Watch for unexpected hidden VNC activity or unusual remote debugging ports opening on endpoints.
Security teams should track modifications to the Windows hosts file. The malware uses specific network commands to add or delete DNS records. Monitor the creation of mutexes matching the hardcoded Global UUID pattern. Additionally, watch for unexpected UAC bypass attempts using the Windows fodhelper binary or the ICMLuaUtil COM interface. Restrict user privileges to limit the impact of these UAC bypass techniques. Finally, keep endpoint detection and response tools updated. By watching these specific behaviors, defenders can catch the Abyssos RAT before major data theft occurs.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
