WogRAT Targets Both Windows and Linux

A recently discovered malicious software, named "WogRAT," is targeting both Windows and Linux systems. It utilizes the online notepad platform called "aNotepad" as a covert channel for storing and extracting malicious code.

As per researchers from AhnLab Security Intelligence Center (ASEC), who have named the malware string "WingOfGod," it has been active since at least the end of 2022, with a focus on countries such as Japan, Singapore, China, Hong Kong, and other Asian nations.

The distribution methods are currently unknown, but the filenames of the extracted executable files resemble those of popular software (e.g., flashsetup_LL3gjJ7.exe, WindowsApp.exe, WindowsTool.exe, BrowserFixup.exe, ChromeFixup.exe, HttpDownload.exe, ToolKit.exe). This suggests that the malware likely spreads through malicious software or similar schemes.

It is noteworthy that aNotepad, a free online notepad platform, is abused in this context to host a base64-encoded .NET binary program of the Windows version of the malware, disguised as an Adobe tool.

Since aNotepad is a legitimate online service, it goes undetected by security tools, contributing to a more discreet infection chain.

When the malware initially runs on the victim's machine, it is less likely to be flagged by antivirus tools as it does not exhibit any malicious functions.

However, the malicious software contains encrypted source code for a malware downloader, which is compiled and executed in motion.

This downloader retrieves another malicious .NET binary program stored in base64-encoded form in Notepad, resulting in the loading of a DLL that serves as the backdoor for WogRAT.

WogRAT's Basic Commands

WogRAT sends a basic profile of the infected system to the command and control (C2) server and receives commands for execution. Five functions are supported:

Command execution
File download from a specified URL
Upload a specified file to C2
Wait for a specified time (in seconds)
Terminate

Malware Comes in Linux Variant as Well

The Linux version of WogRAT, offered in ELF format, shares many similarities with the Windows variant. However, it differs by using Tiny Shell for routing operations and additional encryption in its communication with C2.

Tiny Shell is an open-source backdoor facilitating data exchange and command execution on Linux systems for various threats, including LightBasin, OldGremlin, UNC4540, and the unidentified operators of the Linux rootkit "Syslogk."

Another notable difference is that commands in the Linux variant are not sent via POST requests but are issued through a reverse shell created on a specific IP address and port.