Zscaler ThreatLabz details new Abyssos modular RAT

Zscaler ThreatLabz has published a technical analysis of Abyssos, a new modular remote administration tool (RAT) written in C++. The malware supports credential theft, file exfiltration, and remote access via VNC, and is in active development with multiple versions and obfuscation passes.

ThreatLabz analysed version 2.4F, detailing its obfuscation methods, anti-analysis techniques, network protocol, and supported commands. The malware uses common obfuscation methods and LLVM-based obfuscators, with some samples lacking anti-analysis techniques.

Abyssos encrypts network traffic with AES-GCM using a hardcoded 32-byte key, and modules are additionally encrypted with AES-CBC or XOR. It supports a wide range of commands, including process termination, VNC sessions, browser data theft, UAC bypass, keylogging, and remote shell.

The malware can also download and execute files, inject shellcode, and self-delete. ThreatLabz identified several modules for keylogging, credential harvesting, network scanning, and privilege escalation, though they were not available at the time of analysis.