Blackremote RAT

The Blackremote RAT is a Remote Access Trojan that can give attackers control over your computer. It may manipulate files or settings on your PC, collect information through multiple methods, and provide a hacker with a complete remote administrative UI. Anti-malware services may delete Blackremote RAT or stop it during introductory stages, such as in e-mail attachments.

RAT Attacks with a Lot to Offer Criminals

Remote Access Trojans are holding fast as stable pillars of both state-sponsored cyber-attacks and for-profit, underground marketplace-based campaigns. The Blackremote RAT, as of September, is a new Trojan of this type that's selling on multiple black hat websites, with the usual fig leaf of pretending that it's for legitimate purposes. Even the most basic inspection of its features and promotions show otherwise, and that the Blackremote RAT offers up infected computers on silver platters for attackers.

The Blackremote RAT's author and seller, IDed as Rafiki or Speccy alternately, offers multiple-length rental options for his Trojan, along with upfront, unsafe features like supposed FUD (Fully-Undetectable) encryption for keeping AV tools from detecting it. It's a wide-sweeping program with system-controlling and data-transferral features, as with most Remote Access Trojans.

In their look over its features, however, malware experts are encountering some characteristics in the Blackremote RAT that are especially worthy of notice. The Trojan comes with an 'alarm clock' for alerting the remote admin whenever an unwanted program's memory process appears, which could let attackers react to, for instance, security software. The Blackremote RAT also has in-depth options for controlling TCP connections on a port-by-port basis and editing the Hosts file – which can create browser redirects, hijackings, and blocked websites, just like some versions of the notorious STOP Ransomware family.

Taking Back the Remote to Your Computer

It's equally important to account for the standardized RAT features in the Blackremote RAT, which aren't highly-original but possess the potential for causing harm to businesses and individual users alike. The Blackremote RAT can record the desktop or keyboard, download and upload, hijack the mouse, manage files remotely, control processes and services, collect passwords, access the webcam, initiate reboots and execute scripts. None of these features are out of line for a Remote Access Trojan on the black market, but they all pose significant privacy and security risks to victims.

Even worse than that, malware researchers are verifying that the threat actor for the Blackremote RAT is updating it actively, despite the local authorities having proof of his identity. Further improvements to the Blackremote RAT may heighten its evasion techniques or add features not elaborated on here.

Users are recommended to scan e-mail attachments with appropriate security software, leave macros and in-browser scripts inactive, and monitor messages for possible phishing attempts. Effective anti-malware programs still may delete the Blackremote RAT, which is far simpler than undoing the consequences of the previously-outlined attacks.

The Blackremote RAT is a thriving part of an ecosystem of criminal enterprises that pretends that it's a tool for legitimate activities. Remote administration is only as benign as the admin in question, and a program like the Blackremote RAT is capable of much harm in the wrong hands.