Microsoft recently updated the exclusion permissions of Windows Defender. As long as you do not have administrator rights, you cannot view the specified excluded folders and files. This important change prevents malicious actors from inserting malware payloads into excluded folders to bypass scanning. However, this is not a panacea. Kraken, recently disclosed by security companies, can easily bypass this rule by exploiting loopholes.
Kraken botnet easily tricks Windows Defender into stealing cryptocurrency data
The security research unit ZeroFox has been tracking an unknown new botnet called Kraken since October 2021. It targets Windows systems and is currently being actively evolved and developed. The reason why it can avoid Windows Defender scanning is because it simply adds itself as an exclusion item, rather than stuffing itself into other exclusion items like other malware. In comparison, this method can be said to be both simple and effective.
How does it work? During the installation phase, Kraken ran two commands in order to remain invisible and attempted to move itself to “%AppData%/Microsoft.Net”. Kraken is mainly a malware designed to steal user assets, similar to the recently discovered fake Windows 11 official website fraud website. ZeroFox added that Kraken’s capabilities now include stealing information related to users’ cryptocurrency wallets, directly reminiscent of the recent fake KMSPico Windows malware. The functions of Karaken’s repeated operations include sustainability, collecting registration information of related hosts, downloading and executing files, running Shell commands, stealing various cryptocurrency wallets, screenshots, etc.
Kraken was originally distributed in self-extracting RAR SFX files downloaded by SmokeLoader. These SFX files contain a UPX packaged version of Kraken, the RedLine Stealer, and another binary file for removing Kraken. The current version of Kraken is downloaded directly from SmokeLoader. Kraken binaries are still packaged in UPX, but are now further protected by Themida.
During its evolution, the Kraken C2 seems to disappear often. ZeroFox has observed on several occasions a decrease in activity on a server, only to have another server appear with a brand new IP for a short period of time. By using SmokeLoader propagation, Kraken quickly acquires hundreds of new bots every time it changes C2. Surveillance commands sent to Kraken victims from October 2021 to December 2021 revealed that the developer was entirely focused on promoting information theft, specifically RedLine Stealer. It’s unclear what the developers plan to do with the stolen information that has been collected, or what the ultimate goal is in creating this new botnet.
Source: KOCPC Chinese