LaZagne currently works on 22 Microsoft Windows programs and 12 on Linux/Unix-run operating systems. Vila noted that there are other application hosted on the C&C, one of which is a relabeled version of LaZagne, an open source tool used to retrieve passwords stored on local devices, such as Wi-Fi credentials, web browsers and chat applications, as well as database and mail programs.
QRAT has exfiltration and spying capabilities such as capturing keystrokes, mouse clicks and cursor movement as well as the ability to remotely operate the machine’s web camera to take snapshots or record videos.į-Secure’s Frederic Vila disclosed that the malicious Java file is downloaded from the QARALLAX domain, while its IP address is also used as the command and control server (C&C). visa applications, are currently targeting Swiss nationals, and possibly other travelers around the world.Īccording to the F-Secure’s report and a sample provided by security consultant Hamid Kashfi, victims were sent a file named US Travel Docs Information.jar, which is an application that can run on operating systems installed with the Java Runtime Environment. The scammers, posing as government personnel offering guidance on U.S. Researchers at cybersecurity firm F-Secure have uncovered a malware named Qarallax (QRAT), a remote access trojan (RAT), being distributed through Skype.
0 kommentar(er)
