New HotRat Trojan Spreads via Pirated Games & Software

Cybersecurity researchers have discovered a new variant of the notorious AsyncRAT malware. Dubbed HotRat, the trojan is actively spreading through pirated versions of popular software, including video games, image and sound editing tools, and Microsoft Office.

According to Avast security researcher Martin a Milanek, HotRat's capabilities include stealing login credentials, cryptocurrency wallets, screen capturing, keylogging, installing additional malware, and accessing and altering clipboard data. The malware has been prevalent in the wild since at least October 2022, with infections concentrated in regions such as Thailand, Guyana, Libya, Suriname, Mali, Pakistan, Cambodia, South Africa, and India.

These attacks involve combining cracked software available on torrent sites with a malicious AutoHotkey (AHK) script. This script acts as the infection chain, designed to deactivate antivirus solutions on the compromised host and ultimately deploy the HotRat payload using a Visual Basic Script loader.

HotRat, classified as a comprehensive Remote Access Trojan (RAT) malware, features nearly 20 commands. Each command executes a.NET module received from a remote server, empowering threat actors to enhance its capabilities as required.

Experts highlight that HotRat's deployment process requires administrative privileges on the targeted system. As pirated software usually requires high privileges, victims do not think twice when asked to give these permissions — making infection trivial.

"Despite the substantial risks involved, the irresistible temptation to acquire high-quality software at no cost persists, leading many people to download illegal software," says Milanek. "Therefore, distributing such software remains an effective method for widely spreading malware."

The malware's significant impact has been further emphasized by its abuse of popular software brands, including Adobe and Microsoft products, as well as video games such as Battlefield 3, Age of Empires IV, Red Alert 2, and The Sims 4. Even widely-used utility software like CCleaner has been misused to propagate HotRat through an illegal copy of the product.

HotRat's distribution occurs through various public repositories, with links disseminated on social networks, forums, and torrent sites. Furthermore, the malware utilizes free DNS servers, with the clients’ ports being different for each DNS record. This makes it challenging to track the final IP addresses of the Command and Control (C2) servers.

To safeguard against such threats, Martin a Milanek concludes, “It is critical to re-emphasize the caution against downloading dubious software from unverified sources, especially those demanding the deactivation of antivirus programs, as it can help curb the risk of malware infections and data breaches.”