MgBot

MgBot is a threatening Remote Access Trojan that is believed to be used by a Chinese Advanced Persistent Threat (APT) group. Cybersecurity experts who identified and analyzed the MgBot implant noticed a large number of strings and comments written in Chinese, which shows that the malware might have Chinese roots. The threat was actively spread in the first days of July when it was delivered via different email phishing campaigns that targeted users in Hong Kong and India. It is crucial to add that regular computers are not MgBot's target and, instead, its operators are going after government organizations and political entities.

One of the first campaigns delivered the MgBot alongside a copy of the Cobalt Strike framework, while the last campaign from July 5 carried a malicious document that used a macro script to deploy the MgBot payload. MgBot, also known as Blame or Mgmbot, is a fully-fledged Remote Access Trojan that is likely to be the product of an experienced and skilled malware developer. The threat utilizes advanced techniques to evade anti-virus software and malware analysis environments. It is capable of checking for:

• Drivers, processes, and Registry entries related to virtualized system environments.
• The presence of security modules used by a wide range of anti-virus software suites.
• Malware debugging and analysis tools.

MgBot Avoids Detection via Anti-Debugging and Sandbox-Evasion Techniques

MgBot will not work as expected if it detects any of the things listed above, making it more difficult to capture and identify this malware via honeypot automatically.

Once active, the MgBot RAT may disguise its components as a Realtek Audio Driver that users are unlikely to suspect to be linked to malicious activity. While the Trojan features are rather limited, they are more than enough to provide the attacker with the ability to:

• Grab screenshots of the desktop or specific windows.
• Initialize a keylogger.
• Manage files and directories.
• Manage running processes and services.
• Execute remote commands.

MgBot is a threatening implant that has to be stopped at all costs due to its ability to steal confidential data and perform long-term spying operations. A reputable anti-virus software suite and a well-configured firewall are a must-have for all networks that may become a target of the MgBot or similar malware.