When users download what appears to be a game launcher, the system initiates a multi-stage infection process<\/strong>, in which a batch script (containing comments in Korean) is executed first, followed by a .NET-based malware dropper (distributed under filenames such as \u201cInstaller2.exe\u201d<\/em>, \u201cInstaller3.exe\u201d<\/em>, and \u201cinstallerABAB.exe\u201d<\/em>). This dropper installs and executes the main malicious payload known as \u201cWrnRAT.\u201d<\/p>\n\n\n\n Deceptive page for downloading gambling games (Source \u2013 ASEC)<\/p>\n\n\n\n This dropper operates by creating both a launcher component and the actual WrnRAT malware, executing WrnRAT through the launcher, and then self-destructing to evade detection.<\/p>\n\n\n\n In the final stage, WrnRAT installs itself on the system, disguising itself as \u201cInternet Explorer\u201d by creating a file named \u201ciexplorer.exe\u201d to blend in with legitimate system processes.<\/p>\n\n\n\n The malware was also distributed through HFS platforms, sometimes posing as computer optimization software, demonstrating the attackers\u2019 varied distribution strategies.<\/p>\n\n\n\n Platforms used for malware distribution (Source \u2013 ASEC)<\/p>\n\n\n\n Once successfully installed, WrnRAT provides attackers with remote control over the infected system and allows them to steal sensitive information from the compromised machine.<\/p>\n\n\n\n WrnRAT is a sophisticated malware developed using the Python programming language and packaged into an executable file using PyInstaller.<\/p>\n\n\n\n This RAT primarily operates by capturing and transmitting screenshots from infected computers to the attacker\u2019s system.<\/p>\n\n\n\n Moreover, it collects essential system information and has the capability to terminate certain active processes.<\/p>\n\n\n\n The malware authors have expanded their toolkit by developing additional tools that modify firewall configurations to evade detection.<\/p>\n\n\n\n The primary motivation of these malicious actors appears to be financial exploitation.<\/p>\n\n\n\n They monitor users\u2019 games through unauthorized screenshots, leading to significant financial losses, especially for users accessing illegal gambling platforms.<\/p>\n\n\n\n By observing players' hands, betting patterns, and strategies in real time using the screenshot capture functionality, attackers can gain unfair advantages or steal sensitive information.<\/p>\n\n\n\n Here are some essential preventive measures:<\/p>\n\n\n\n MD5<\/strong><\/p>\n\n\n\n Suspicious URLs:<\/strong><\/p>\n\n\n\n Suspicious FQDN Domains:<\/strong><\/p>\n\n\n\n Original article Notorious WrnRAT Delivered Mimic As Gambling Games<\/a> published by Cyber Security News<\/a>.<\/p>","protected":false},"excerpt":{"rendered":" Hackers mainly target gambling due to the profitable financial opportunities it offers. The online gambling industry is a fertile ground for malicious actors seeking to exploit vulnerabilities for financial gain and data theft.<\/p>","protected":false},"author":1,"featured_media":557,"comment_status":"closed","ping_status":"closed","sticky":true,"template":"single-with-sidebar","format":"standard","meta":{"footnotes":""},"categories":[17],"tags":[39],"class_list":["post-197","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-homepage"],"_links":{"self":[{"href":"https:\/\/inforb.ro\/en\/wp-json\/wp\/v2\/posts\/197","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/inforb.ro\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/inforb.ro\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/inforb.ro\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/inforb.ro\/en\/wp-json\/wp\/v2\/comments?post=197"}],"version-history":[{"count":7,"href":"https:\/\/inforb.ro\/en\/wp-json\/wp\/v2\/posts\/197\/revisions"}],"predecessor-version":[{"id":878,"href":"https:\/\/inforb.ro\/en\/wp-json\/wp\/v2\/posts\/197\/revisions\/878"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/inforb.ro\/en\/wp-json\/wp\/v2\/media\/557"}],"wp:attachment":[{"href":"https:\/\/inforb.ro\/en\/wp-json\/wp\/v2\/media?parent=197"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/inforb.ro\/en\/wp-json\/wp\/v2\/categories?post=197"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/inforb.ro\/en\/wp-json\/wp\/v2\/tags?post=197"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"\"](\"https:\/\/inforb.ro\/wp-content\/uploads\/2024\/09\/Deceitful-page-for-downloading-gambling-games-Source-ASEC-1024x559.jpg\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/inforb.ro\/wp-content\/uploads\/2024\/09\/Platforms-used-for-malware-distribution-Source-ASEC-1024x404.jpg\")
<\/figure>\n\n\n\nPreventive Measures<\/strong><\/h2>\n\n\n\n
\n
Indicators of Compromise (IOCs)<\/strong> (IoCs)<\/strong><\/h2>\n\n\n\n
0159b9367f0d0061287120f97ee55513
03896b657e434eb685e94c9a0df231a4
0725f072bcd9ca44a54a39dcec3b75d7
0d9e94a43117a087d456521abd7ebc03
1b8dfc3f131aaf091ba074a6e4f8bbe6<\/pre>\n\n\n\nhttp[:]\/\/112[.]187[.]111[.]83[:]5723\/installerABAB\/MicrosoftEdgeUpdate[.]exe
http[:]\/\/112[.]187[.]111[.]83[:]5723\/installerABAB\/bound[.]exe
http[:]\/\/112[.]187[.]111[.]83[:]5723\/installerABAB\/iexplore[.]exe
http[:]\/\/112[.]187[.]111[.]83[:]5723\/installerABAB\/installerABAB[.]cmd
http[:]\/\/112[.]187[.]111[.]83[:]5723\/installerABAB\/installerABAB[.]exe<\/pre>\n\n\n\naaba1[.]kro[.]kr
delete1[.]kro[.]kr
inddio23[.]kro[.]kr
nt89kro[.]kr
nt89s[.]kro[.]kr<\/pre>\n\n\n\n