BlackSoul Malware

The BlackSoul Malware is a threatening application that was first identified and analyzed in November when discovered on Turkmenistan computers. The malware seems to possess features typical for Remote Access Trojans (RATs), and it does not share similarities with previously known malware families. It is highly likely that the BlackSoul Malware was developed from scratch.

The BlackSoul Malware implant is controlled by the attacker through a remote server, which can transmit commands to the payload. The BlackSoul implant functionality is not spectacular, but it provides its operators with access to enough commands to collect data and cause damage to the infected system. Some of its functionality includes:

• Execute a remote command.
• Download files from a specified URL.
• Collect a specific file and transfer it to the control server.
• Update the implant's configuration.

The BlackSoul Malware is believed to be the product of the same criminals behind the BlackWater malware. This campaign's exact targets are not yet identified, but the initial sample was submitted by a user in Turkmenistan. In the meantime, cybersecurity experts discovered decoy documents that were used to spread the BlackSoul Malware – these were written in English and copied the names/contents of legitimate documents from the National Institute of Standards and Technology (NIST).

Users should take preventive measures to stop BlackSoul Malware's attack by investing in a reputable anti-malware application, as well as by following the best safe Web browsing security practices.