SamoRAT

Remote Access Trojans (RATs) are one of the most threatening tools in the arsenal of cybercriminals – they often allow the attacker to access all of the victim's files, and it also enables them to execute a wide variety of actions that may allow them to monitor conversations, collect login credentials, manage the system's configuration, collect financial information and more. One of the latest RATs to be seen in the wild is called the SamoRAT, and it does not appear to be based on any of the previously known malware families.

So far, the SamoRAT has been distributed via fraudulent email attachments and pirated software or games almost exclusively – the attackers do not target a specific region and, instead, are focusing on spreading a threatening program to as more people as possible. If the SamoRAT manages to infiltrate a system, it may plant its files in multiple system folders by impersonating the names of legitimate Windows components. In addition to this, the SamoRAT gains persistence by setting up a new Windows Service, Windows Scheduled Task, and a Windows Registry Key responsible for starting applications automatically.

Since the SamoRAT is meant to be used for prolonged periods, the malware is able to work in the background silently without raising any red flags. Victims of the SamoRAT may not notice anything out of the ordinary while a remote cybercriminal is spying on them, recording footage through their Web camera or browsing their files. It is strongly recommended to prevent stealthy malware implants like SamoRAT by using a trustworthy and regularly updated anti-malware service.