Malware families coverage: Misusing Coronavirus disease [COVID-19] scare

While the world is suffering from Coronavirus disease (COVID-19) pandemic, malware authors are not missing their chances to take advantage from the pandemic scare and making the situation worse for the people. The SonicWall Threats Research team first observed the corona scares used by malware authors on February 4, 2020 and then keeping an eye on the campaign. We observed that COVID-19 scare is not only used by one malware family, perhaps multiple malware families are using the scare to get into the victim’s machine. The malware authors majorly distributing the malware files as an email attachment, stating it as COVID-19 related document. We have listed malware families which are misusing COVID-19 scare since Jan 2020.

GOZ InfoStealer:

The GOZ InfoStealer is known for stealing user data from installed applications, along with victim’s system information, which is then sent to the threat actor over Simple Mail Transfer Protocol.

Remcos RAT:

REMCOS designed as Remote Control and Surveillance tool for legitimate purpose but it is being used by malware authors from a few years. The malware gathers and sends victim’s system information to its Command and Control (C&C) server and it is also capable of performing the tasks below:

• Screen Capture
• Remote CommandLine
• Remote Registry Editor
• Download, Upload and Execute files
• Login cleaner

NanoCore RAT:

NanoCore Remote Access Trojan (RAT) is known for spying and stealing victim’s machine information:

After looking into the delivery patterns and agent files involved in executing the Remcos and NanoCore on victim’s machine, we can say the malware families have somehow linked to each other.

NetWire RAT:

NetWire RAT enables access to the victim’s machine from the remote host:

HawkEye RebornX:

HawkEye has been active in the wild from the last few years. It has the features below:

• Key-logging
• Password stealing
• Screen capture
• Clipboard

Unclassified InfoStealer:

This InfoStealer’s behavior is very much similar to GOZ InfoStealer, it steals user data from installed application and clipboard:

Evidence of the detection by RTDMI(tm) engine for each malware family can be seen below in the Capture ATP reports:

GOZ InfoStealer

Remcos RAT

NanoCore RAT

NetWire RAT

HawkEye Reborn

Security News

The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from the SonicWall Capture Threat network, consisting of global devices and resources, including more than 1 million security sensors in nearly 200 countries and territories. The research team identifies, analyzes, and mitigates critical vulnerabilities and malware daily through in-depth research, which drives protection for all SonicWall customers. In addition to safeguarding networks globally, the research team supports the larger threat intelligence community by releasing weekly deep technical analyses of the most critical threats to small businesses, providing critical knowledge that defenders need to protect their networks.