Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

9/3/2013
02:20 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

'Hand Of Thief' Linux Trojan Not Ready For Prime Time

Researchers find that Russian cybercriminals' new malware toolkit for targeting Linux platforms currently unable to effectively steal data

What was touted as the first banking Trojan to attack all major Linux distributions so far isn't as lethal as was predicted. The so-called Hand of Thief, or HoT, malware kit that recently hit the underground currently has little or no "grabbing" capabilities, according to new research.

The HoT malware kit came on the underground Russian cybercrime market in late July, selling for $2,000, including free updates. The first iteration was touted to include form grabbers and backdoors, and claims to run on 15 different Linux distributions, including Ubuntu, Fedora, and Debian. But researchers at RSA's FraudAction team recently obtained and tested HoT binaries and its builder and found its features aren't so hot after all.

"Our research and analysis shows that, in reality, HoT's grabbing abilities are very limited, if not absent, which would make the malware a prototype that needs a lot more work before it can be considered a commercially viable banking Trojan," says Yotam Gottesman, senior security researcher for RSA FraudAction Research Labs.

The Trojan -- which has not yet been detected in any attacks at this time -- includes a builder, a Windows executable that allows a botmaster to generate new variants of the malware on-demand.

"In his sales adverts, Hand of Thief's developer explained that he is in the final stages of implementing the web-injection mechanism for the malware. Researching the Trojan proved that no injections are currently in place, but the preparation for such a mechanism is," Gottesman says in a blog post today about the research.

RSA tested the Trojan and found it could indeed inject itself into a browser process, but, in most cases, froze or crashed the browser. "When using Firefox on the infected machine, HoT captured only empty requests with no information being delivered to the drop server. When browsing with Google Chrome, HoT did manage to capture some requests and relay them to its server," Gottesman says.

But the Trojan had no way to filter information, so it would capture all requests from the browser in a generic manner, which would clog the drop server with "useless data," according to RSA.

RSA says HoT's developer doesn't offer a recommended method of infection besides email or social engineering tactics. But it does come with some anti-virtual machine functions to deter researchers, RSA found. It also employs packing to avoid detection. "Beyond using a packer and string obfuscation, it appears that HoT's developer invested in additional anti-research functions, one of which is Anti-Virtual Machines," Gottesman says.

The bottom line is HoT is more of a work in progress than a commercial tool as yet. "Although it initially appeared to be a compelling new Trojan entrant, RSA's in-depth analysis of the code proves it is a prototype more than true commercially viable malware, crashing the browsers on the infected machines and displaying overall inability to properly grab data," Gottesman says.

It's also easy to eradicate. "Furthermore, HoT can also be easily removed from the machine by deleting the files dropped during the HoT installation process," he says.

The full blog post, including screen shots, is available here.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/6/2020
Introducing 'Secure Access Service Edge'
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  7/3/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5604
PUBLISHED: 2020-07-09
Android App 'Mercari' (Japan version) prior to version 3.52.0 allows arbitrary method execution of a Java object by a remoto attacker via a Man-In-The-Middle attack by using Java Reflection API of JavaScript code on WebView.
CVE-2020-5974
PUBLISHED: 2020-07-08
NVIDIA JetPack SDK, version 4.2 and 4.3, contains a vulnerability in its installation scripts in which permissions are incorrectly set on certain directories, which can lead to escalation of privileges.
CVE-2020-15072
PUBLISHED: 2020-07-08
An issue was discovered in phpList through 3.5.4. An error-based SQL Injection vulnerability exists via the Import Administrators section.
CVE-2020-15073
PUBLISHED: 2020-07-08
An issue was discovered in phpList through 3.5.4. An XSS vulnerability occurs within the Import Administrators section via upload of an edited text document. This also affects the Subscriber Lists section.
CVE-2020-2034
PUBLISHED: 2020-07-08
An OS Command Injection vulnerability in the PAN-OS GlobalProtect portal allows an unauthenticated network based attacker to execute arbitrary OS commands with root privileges. An attacker requires some knowledge of the firewall to exploit this issue. This issue can not be exploited if GlobalProtect...