{"id":16269,"date":"2023-07-25T08:47:08","date_gmt":"2023-07-25T08:47:08","guid":{"rendered":"https:\/\/gridinsoft.com\/blogs\/?p=16269"},"modified":"2023-07-25T09:09:03","modified_gmt":"2023-07-25T09:09:03","slug":"pirated-software-and-hotrat","status":"publish","type":"post","link":"https:\/\/gridinsoft.com\/blogs\/pirated-software-and-hotrat\/","title":{"rendered":"Trojan HotRat Is Distributed through Pirated Versions of Software and Games"},"content":{"rendered":"

Avast experts have warned that a new variant of AsyncRAT malware, called HotRat, is distributed through pirated versions of popular programs and utilities. This includes games, Microsoft Office, and audio and image editing software. That is not the only malware activated via an unusual spreading channel. We recently covered the IcedID and Gozi trojans<\/a> spreading<\/strong> through malvertising. Additionally, hackers started spreading a trojanized TeamViewer installer that contains njRAT trojan.<\/p>\n

The original AsyncRAT<\/strong> (Remote Access Trojan) is designed to remotely monitor and control infected computers over a secure encrypted connection. Its “successor”, HotRat<\/strong>, has been active since at least October 2022, with most infections concentrated in Thailand, Guyana, Libya, Suriname, Mali, Pakistan, Cambodia, South Africa and India.<\/p>\n

HotRat malware provides attackers with a wide range of options, including stealing credentials, cryptocurrency wallet information, screen capture, keylogging, installing additional malware, and accessing and modifying clipboard data.the experts write.<\/a><\/span><\/div><\/div>\n

HotRat spreads by combining a malicious AutoHotkey<\/strong> script with various hacked software, which is usually available on torrent trackers. The script initiates the chain of infection and is designed to deactivate antiviruses on a compromised host, as well as launch the HotRat payload using the Visual Basic script loader.<\/p>\n

\"HotRat
Attack scheme<\/figcaption><\/figure>\n

Experts describe HotRat as a comprehensive RAT that supports nearly 20 commands, each of which executes a .NET module received from a remote server, which allows malware operators to extend its functionality as needed.<\/p>\n

Despite the significant risks, the irresistible temptation to get quality software for free remains, which forces many people to download illegal software. Therefore, such software is still an effective method for the widespread distribution of malware.the researchers conclude.<\/span><\/div><\/div>\n

The media also wrote that the QBot<\/strong> Trojan can steal information from emails of users of infected systems<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

Avast experts have warned that a new variant of AsyncRAT malware, called HotRat, is distributed through pirated versions of popular programs and utilities. This includes games, Microsoft Office, and audio and image editing software. That is not the only malware activated via an unusual spreading channel. We recently covered the IcedID and Gozi trojans spreading […]<\/p>\n","protected":false},"author":3,"featured_media":16277,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","_sitemap_exclude":false,"_sitemap_priority":"","_sitemap_frequency":"","footnotes":""},"categories":[15],"tags":[24],"class_list":{"0":"post-16269","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-security-news","8":"tag-trojan"},"featured_image_src":"https:\/\/gridinsoft.com\/blogs\/wp-content\/uploads\/2023\/07\/pirated-software-and-HotRat.jpg","author_info":{"display_name":"Vladimir Krasnogolovy","author_link":"https:\/\/gridinsoft.com\/blogs\/author\/krasnogolovy\/"},"_links":{"self":[{"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/posts\/16269","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/comments?post=16269"}],"version-history":[{"count":5,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/posts\/16269\/revisions"}],"predecessor-version":[{"id":16280,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/posts\/16269\/revisions\/16280"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/media\/16277"}],"wp:attachment":[{"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/media?parent=16269"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/categories?post=16269"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/gridinsoft.com\/blogs\/wp-json\/wp\/v2\/tags?post=16269"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}