Hand Of Thief Linux Trojan Not Ready For Prime Time

Researchers find that Russian cybercriminals new malware toolkit for targeting Linux platforms currently unable to effectively steal data

What was touted as the first banking Trojan to attack all major Linux distributions so far isnt as lethal as was predicted. The so-called Hand of Thief, or HoT, malware kit that recently hit the underground currently has little or no grabbing capabilities, according to new research.
The HoT malware kit
came on the underground Russian cybercrime market in late July
, selling for $2,000, including free updates. The first iteration was touted to include form grabbers and backdoors, and claims to run on 15 different Linux distributions, including Ubuntu, Fedora, and Debian. But researchers at RSAs FraudAction team recently obtained and tested HoT binaries and its builder and found its features arent so hot after all.
Our research and analysis shows that, in reality, HoTs grabbing abilities are very limited, if not absent, which would make the malware a prototype that needs a lot more work before it can be considered a commercially viable banking Trojan, says Yotam Gottesman, senior security researcher for RSA FraudAction Research Labs.
The Trojan -- which has not yet been detected in any attacks at this time -- includes a builder, a Windows executable that allows a botmaster to generate new variants of the malware on-demand.
In his sales adverts, Hand of Thiefs developer explained that he is in the final stages of implementing the web-injection mechanism for the malware. Researching the Trojan proved that no injections are currently in place, but the preparation for such a mechanism is, Gottesman says in a blog post today about the research.
RSA tested the Trojan and found it could indeed inject itself into a browser process, but, in most cases, froze or crashed the browser. When using Firefox on the infected machine, HoT captured only empty requests with no information being delivered to the drop server. When browsing with Google Chrome, HoT did manage to capture some requests and relay them to its server, Gottesman says.
But the Trojan had no way to filter information, so it would capture all requests from the browser in a generic manner, which would clog the drop server with useless data, according to RSA.
RSA says HoTs developer doesnt offer a recommended method of infection besides email or social engineering tactics. But it does come with some anti-virtual machine functions to deter researchers, RSA found. It also employs packing to avoid detection. Beyond using a packer and string obfuscation, it appears that HoTs developer invested in additional anti-research functions, one of which is Anti-Virtual Machines, Gottesman says.
The bottom line is HoT is more of a work in progress than a commercial tool as yet. Although it initially appeared to be a compelling new Trojan entrant, RSAs in-depth analysis of the code proves it is a prototype more than true commercially viable malware, crashing the browsers on the infected machines and displaying overall inability to properly grab data, Gottesman says.
Its also easy to eradicate. Furthermore, HoT can also be easily removed from the machine by deleting the files dropped during the HoT installation process, he says.
The full blog post, including screen shots, is available
here
.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Hand Of Thief Linux Trojan Not Ready For Prime Time