Atrax is the name of the last crimekit that is sold in the underground market, its particularity is the capability to exploit Tor networks to communicate with Command & Control infrastructure. Jonas Mønsted of the Danish security firm CSIS, published a blog post that describes in depth the crimekit. The malware isn’t the first agent that adopted as communication channel the Tor network, we found in the past other botnets exploiting the same trick to high malicious traffic, recently Mevade was responsible for the spike in the Tor traffic, while going further back in time we can mention Skynet The Atrax crime kit is cheap, it is available for runs about $250, and appears very attractive due a series of features like Bitcoin mining, Litecoin mining, browser data extraction and a component to launch DDoS attacks. The DDoS module offer complete support for both Full IPv6 and IPv4 and implements principal attack techniques including UDP Flood,TCP Flood,TCP Connect Flood, HTTP Slowloris and many other methods. The recent explosion in Bitcoin value is attracting cybercrime, for this reason authors of Atrax included in the crimekit dedicated features including the capability to steal information from users’ Bitcoin wallets (such as Armory, Bitcoin-Qt, Electrum and Multibit).
As many other crimekit, Atrax was designed with a modular structure, a series of add-ons implements the above functionalities and follow an efficient model of sale, a plugin stealer is sold for $110, the form grabber for $300 and an experimental add-on for coin mining at $140, surprising the fact that Atrax comes with free updates, bug fixes and support. Below a list of standard features present in the Atrax crimekit:
“Apparently the author admits that the main component, which has a fairly big size of ~1,2 MB is due to TOR integration and x64/x86 code. However a first stage free assembler web downloader ~2KB is also available making the infection process slighly lightweight.” has written Mønsted.
The plug-in stealer according the author is very efficient and implements a wealth of functionality:
It it so able to operate with principal browsers available on the market. No doubt, Atrax crimekit has all the characteristics to succeed in the underground criminal.
(Security Affairs – Atrax crimekit, Tor, malware)
Experts found two vulnerabilities in the vBulletin forum software, one of which is already being…
Security Affairs Malware newsletter includes a collection of the best articles and research on malware…
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best…
Qualys warns of two information disclosure flaws in apport and systemd-coredump, the core dump handlers in Ubuntu, Red Hat Enterprise…
Meta stopped three covert operations from Iran, China, and Romania using fake accounts to spread…
The U.S. sanctioned Funnull Technology and Liu Lizhi for aiding romance scams that caused major…
This website uses cookies.
