SDBbot RAT

The SDBbot RAT is a Remote Access Trojan that is characteristic of the attacks of the TA505 threat actor. As such, users may encounter it after opening corrupted e-mail attachments or linked downloads that contain vulnerabilities such as misused macros. The Trojan can provide an attacker with control over the PC and data-collecting features, and users should have their anti-malware solutions remove the SDBbot RAT infections as soon as possible.

Security Problems that Come in a Three-Part Structure

The evolution of Remote Access Trojans with profit-focused criminals like the TA505 group can only go so far; no matter how often a RAT receives patches or updated installation exploits, it still requires abusing various, well-known security loopholes. Such as the SDBbot RAT, one of the latest administrative tools of TA505, which is a brand-new Trojan with a three-part persistence and attack methodology that, still, requires overlooking the most basic of security practices by the victim.

The SDBbot RAT is taking advantage of macro exploits in Excel spreadsheets that recipients must enable for triggering. However, it isn't the first-stage threat of the infection; instead, the vulnerability loads a Trojan downloader, Get2, which can install the SDBbot RAT. Malware experts also find it likely that Get2 forms part of the installation and persistence-establishing sequence for the SDBbot RAT, which can't, by itself, perform the rebooting and reloading functionality that it requires during its setup.

After the user commits this egregious error in safe file interactions, the SDBbot RAT establishes itself in three parts. The installer component disguises its Registry entries with Microsoft information and, depending on account privileges and other details, may create two types of DLL loaders or use a non-DLL application shimming exploit. Application shimming is a technique for maintaining a buffer of information between Windows and an application, with the intended purpose of facilitating backward-compatibility.

What Perils a Spreadsheet Holds

There are some reported cases of the SDBbot RAT's installation coming along with other threats, such as the FlawedAmmyy RAT, although malware experts can only speculate of the purpose of running multiple Remote Access Trojans on a single machine. By itself, however, the SDBbot RAT includes many features for harming the PC's security and privacy. It can read, write, or delete files, execute shell commands, enable Remote Desktop features, perform DLL injections, create proxy servers and record the desktop.

For all of its features and advanced persistence mechanisms, the SDBbot RAT is just as weak at the first point of infection as WhiteShadow, Ostap or AndroMut. All of these threats need victims that willingly enable macros inside of their corrupted documents before the installation can occur. For their part, all users should leave macros inactive unless they've scanned the file with a security solution and confirmed its safety.

The SDBbot RAT's stores its body in the Windows, and inappropriate editing of this file can harm the OS or other programs. Although malware researchers rate the SDBbot RAT as being well-maintained, it still goes back to old watering holes for sustenance. No matter how current its macro exploits might be, a Trojan like the SDBbot RAT can't work around the need for user consent – one way or another.