FHN 
KGB RAT is a Windows remote access trojan (RAT) that can allow attackers to monitor infected computers, steal login credentials, record keystrokes, and control devices remotely.
The malware is sold through a malware-as-a-service model. Its operators advertise a tool designed to evade Windows Defender and other antivirus products. However, these claims are not proof that every version can bypass security protections.
Researchers at Group-IB analyzed KGB RAT and found several dangerous capabilities, including credential theft, remote desktop access, keylogging, and ransomware-related features.
KGB RAT Malware and Its Evasion Techniques
According to Group-IB’s research, KGB RAT has been promoted on underground forums as a commercial malware tool. The sellers offer a payload builder that can generate files in formats such as EXE, BAT, HTA, and REG.
Researchers found that analyzed samples were based on an obfuscated version of NjRAT, an existing remote access trojan.
Once executed, the malware can attempt to establish persistence and collect information about the infected computer. Group-IB observed several techniques, including:
- File disguise: The malware copied itself into a temporary folder and relaunched under the name
svchost.exe, resembling a legitimate Windows process. - Scheduled task creation: It created a task named
ChromeUpdateto help it run again when the user signs in. - System changes: It modified Windows settings related to hidden files and security warnings.
- Security checks: It collected information about running processes, installed security products, and the operating system.
These activities can help the malware remain active and gather information about the environment.
How KGB RAT Steals Data and Controls Computers
KGB RAT combines several capabilities that can put personal and business information at risk.
Group-IB’s analysis identified features designed to:
- Steal credentials: Access Windows Credential Manager files containing saved sign-in information.
- Record activity: Capture keystrokes, screenshots, and clipboard contents.
- Control devices remotely: Use remote desktop functionality, including a hidden VNC feature.
- Monitor cryptocurrency transactions: A Crypto Clipper component in an analyzed sample could potentially replace copied cryptocurrency addresses.
- Communicate with attackers: Send infection notifications through Telegram and contact command-and-control (C2) servers for instructions.
The researchers also observed the sample checking for virtual machines and analysis tools. Such checks may help malware operators identify environments used for security research.
The seller advertises a crypter intended to hide the malware from antivirus detection. However, Group-IB reported that its analysis platform detected samples through their behavior, demonstrating why obfuscation alone does not guarantee evasion.
How to Protect Windows Systems
Organizations should focus on preventing unauthorized execution and detecting suspicious activity.
Recommended measures include:
- Keep Windows and endpoint protection software updated.
- Block unapproved applications and suspicious executable files.
- Monitor unusual scheduled tasks, especially those created by programs running from temporary folders.
- Investigate unexpected registry changes and suspicious outbound connections.
- Watch for unusual credential access, keylogging behavior, and remote desktop activity.
- If infection is suspected, isolate the affected device, investigate the incident, and reset exposed credentials from a clean system.
KGB RAT highlights the risks posed by commercially distributed malware. Even when attackers rely on existing malware code, a combination of credential theft, persistence, and remote control can create serious security consequences.
For defenders, the priority is not simply identifying a suspicious file. It is detecting the behavior that reveals an attack and responding before sensitive information is compromised.
IoCs
| Type | Indicator |
|---|---|
| Primary C2 | 104[.]248[.]130[.]195 — ports 7489, 7490, 7492 |
| Secondary C2 | 2[.]59[.]134[.]215 — port 443 |
| Geolocation service | ip-api[.]com/json/ |
| Telegram notification | api[.]telegram[.]org/bot*/sendMessage |
| Malware website | kgbrat[.]org |
| Command delimiter | |Ghost| |
| Scheduled task | ChromeUpdate |
| Masquerade name | svchost.exe dropped in %TEMP% |
| SHA-256 | 559df774411724520865fa15aa8b7e209d0ee133db4dc3d3cd180e895d597a36 |
| SHA-256 | 581c440644f93a17191b98158c467be5ae5972ab19668c6e8530a2034833bd45 |
| SHA-256 | d4fc7867caf1349bbbfd1f2972fe92acedd8507ae89fa822c07f09a194127894 |
| SHA-256 | d8fb0d64ea8b4a32d6c5869212a62a3c9c6357e4fd7e4cf090a67d22d8f78b62 |
| SHA-256 | df792f965f693b0a2b5bffd9a1ea5127cbd4b13daa9ddb2559f54523604777d8 |
| SHA-256 | 836ebabb6304dd873343e85eb51a9e8c9b3de8a68d5152c3ab0d496c8fc0fdf7 |
| SHA-256 | 1b3c95cf2a030df15d1474af2ae96bfe9a6ed160319c1a8782237206035d82c7 |
| SHA-256 | d691e9721c38104777664f8afd3941ededcadd433b3b593de3e21aa14d60f1f2 |
| SHA-256 | 22255c3c488d4c92ea3567d1032e7a7c790a22cde989a8f0eb257c2d6d811ed4 |
| SHA-256 | 25eb0dfbe57dc07d461e62643262c45de052b012529ad05c7f19c5eb0c1ed646 |
| SHA-256 | 8c3e8d0a5fadbd696bcbd56313d69d94f41f1b2678cfea4db83999a6ad62a63e |
| SHA-256 | 3d71f8b5171f2fe47d9a247a193c1b48c1aaa4d533811e208b8d94ffa5800c9e |
About the Author
