KGB RAT Uses Crypter to Bypass Defender in New Malware Campaign
Researchers find KGB RAT combines NjRAT code with evasion tools to spy on Windows users and steal credentials.
Key points
- KGB RAT repackages NjRAT 0.7D code with a crypter to evade detection.
- The malware uses delayed execution and VM checks to hide from analysis.
- Persistence is established via scheduled tasks and file renaming.
Researchers identified a new Windows remote access trojan named KGB RAT that markets itself as legitimate administration software. According to GBHackers, the malware combines surveillance and credential theft capabilities with a built-in crypter designed to bypass Windows Defender.
The threat leverages existing commodity malware code rather than introducing entirely novel functionality. Static analysis revealed strong similarities to NjRAT 0.7D Lime Edition. This suggests the KGB RAT operators are repackaging established capabilities from the NjRAT family. Existing signatures for NjRAT also match the analyzed samples.
Evasion and Persistence Tactics
KGB RAT employs multiple techniques to avoid detection during initial scans and sandbox analysis. The malware includes virtual machine checks and detection methods for analysis tools. It also uses runtime deobfuscation and delayed execution to confuse security researchers. One analyzed sample invoked a 600-second sleep command. This delay potentially allows the malware to outlast short observation windows in automated sandboxes.
The malware further examines hardware characteristics, printer lists, USB history, and user activity to identify artificial environments. During execution, the initial sample copied itself to the user’s temporary directory. It then relaunched as svchost.exe to mimic a legitimate system process.
Impact on Victims
The malware establishes persistence by creating a scheduled task named ChromeUpdate. This task is configured to execute at logon while requesting the highest available privilege level. The malware modifies Explorer settings to suppress the visibility of protected files. It also invokes PowerShell to refresh open Explorer windows.
Group-IB reported detecting analyzed samples despite their obfuscation or delivery through droppers. Their October 14 analysis links the malware to NjRAT and documents keylogging, reconnaissance, and victim notifications through Telegram. Most examined samples were x86 .NET executables written primarily in VB.NET.
What should you do?
Security teams should monitor for suspicious scheduled tasks and renamed system processes. Analysts should investigate unexpected PowerShell invocations and changes to Explorer settings. Organizations should review Telegram bot activity if available in their monitoring stack. Users should remain cautious of software advertised as fully undetectable.
What to do and how to stay safe: KGB RAT
- Monitor for scheduled tasks with generic names like ChromeUpdate that request high privileges.
- Investigate processes running from temporary directories that mimic system files like svchost.exe.
- Check for unexpected modifications to Explorer settings or protected file visibility.
- Review logs for PowerShell activity that refreshes open windows or executes unknown scripts.
Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is KGB RAT a new malware family or a repackaged tool?
It is a repackaged tool that uses code from the NjRAT 0.7D Lime Edition.
How does KGB RAT evade Windows Defender?
It uses a built-in crypter, obfuscation, and delayed execution techniques.
What persistence method does KGB RAT use?
It creates a scheduled task named ChromeUpdate to run at logon with high privileges.
