Pierluigi Paganini
October 25, 2020
Researchers from MalwareHunterTeam have spotted a new piece of remote access trojan (RAT) dubbed ‘Abaddon’ that is likely the first malware using the Discord platform as command and control. The Abaddon malware connects to the Discord command and control server to check for new commands to execute.
Experts also warn that the author of the malware also developed a malware feature.
In the past, other threat actors already abused the Discord platform for different purposes, such as using it as a stolen data drop.
“In the past, we have reported on how threat actors use Discord as a stolen data drop or have created malware that modifies the Discord client to have it steal credentials and other information.” reported Bleeping Computer that first reported the news.
Abaddon implements data-stealing feature, it was designed to steal multiple data from the infected host, including Chrome cookies, saved credit cards, and credentials, Steam credentials, Discord tokens and MFA information.
The malware also collects system information such as country, IP address, and hardware information.
According to Bleeping Computer the malware supports the following commands:
The malicious code connects to the Command & Control every ten seconds for new tasks to execute.
Experts pointed out that the malware also implements the commands to encrypt files of the infected system and decrypt them.
The ransomware feature appears to be under development.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Abaddon)
[adrotate banner=”5″]
[adrotate banner=”13″]
Hacking / November 23, 2024
