BORAT – Remote Access Trojan

Researchers have discovered a new RAT, named Borat, that enables operators to gain full access and remote control of an infected system.

Unlike other RATs, the Borat RAT provides Ransomware and DDOS services to attackers expanding their capabilities. Also allows its operators to compile the malware binary for performing specific features, including DDoS and ransomware attacks.

The RAT has a modular structure, each module implements a specific functionality. Below a list of the modules analyzed :

• Keylogger
• Ransomware
• DDOS
• Audio Recording
• Webcam recording 
• Remote desktop 
• Reverse proxy 
• Device information 
• Process hollowing 
• Credential stealing 
• Discord token stealing 

The BORAT RAT is also able to perform the following activities to disturb the victims: Play Audio, Swap Mouse Buttons, Show/hide the Desktop, Show/hide the taskbar, Hold Mouse, Enable/Disable webcam light, Hang System, Monitor Off, Blank screen, etc.  

Indicators of Compromise