AhnLab ASEC observed attacks where threat actors abused legitimate RMM tools LogMeIn Resolve and PDQ Connect to deploy the PatoRAT backdoor by luring users to fake utility download pages that install the RMM client disguised as common programs. The campaigns used multiple LogMeIn CompanyId values and C2 domains such as patolino.theworkpc.com and secondfloor.dynuddns.com to exfiltrate data and enable remote control. #PatoRAT #LogMeInResolve
Keypoints
- Threat actors distributed LogMeIn Resolve and PDQ Connect disguised as legitimate utility installers (e.g., Notepad++, 7-Zip) via fake download pages.
- Installed RMM clients were registered to threat-controlled accounts identified by distinct LogMeIn “CompanyId” values (three observed IDs).
- Attackers used the RMM tools to execute PowerShell commands and drop PatoRAT, a Delphi-based backdoor with data theft and remote control features.
- PatoRAT’s configuration is XOR (0xAA) encrypted in the binary resource named “APPCONFIG” and includes clientTag, mutex, and C2 list.
- PatoRAT collects detailed system info (ID, locale, computer/user name, OS, privileges, memory, active window, monitors) and supports remote control, HVNC, keylogging, credential theft, and port forwarding.
- IOCs provided include multiple malicious executable URLs, MD5 hashes, and C2 FQDNs such as patolino.theworkpc.com and secondfloor.dynuddns.com.
- Recommended mitigations: verify official download sites and certificates, check version information, and keep OS and security products updated.
MITRE Techniques
- [T1071 ] Application Layer Protocol – PatoRAT communicates with C2 servers to exfiltrate information and receive commands (“contains the clientTag, mutex name, C&C server address list” and sends system info to C&C).
- [T1059 ] Command and Scripting Interpreter – Threat actors executed PowerShell commands through abused RMM tools to install PatoRAT (“the threat actor exploited LogMeIn to execute PowerShell commands and install PatoRAT”).
- [T1218 ] Signed Binary Proxy Execution – Use of legitimate RMM tools (LogMeIn Resolve, PDQ Connect) to execute malicious actions and bypass security controls (“LogMeIn Resolve … supports remote support … being exploited by various threat actors” to bypass detection).
- [T1566 ] Phishing (Drive-by Compromise variant) – Fake download pages masquerading as utility download sites delivered the RMM installer disguised as normal programs (“websites disguise themselves as the download page of free utilities such as Notepad++ and 7-Zip, but actually download the threat actor’s LogMeIn Resolve”).
- [T1078 ] Valid Accounts – Threat actors used LogMeIn CompanyId configurations to register and control legitimately installed RMM clients (“the “CompanyId” field is the ID of the administrator or threat actor who created the LogMeIn Resolve installation file”).
- [T1005 ] Data from Local System – PatoRAT collects local system information and steals browser credentials and other data (“send the following basic information about the system to the C&C server” and “Steal web browser credentials”).
- [T1083 ] File and Directory Discovery – PatoRAT gathers system and environment details (CPU, environment variables, computer name, volume serial) to build an infected system ID (“Infected System ID (Combination of information such as CPU, environment variables, computer name, and volume serial number)”).
Indicators of Compromise
- [MD5 ] Malware sample hashes – 04547ab017b84bc1934b39513fd8bad2, 082823d138f9da9b085be91161c3cd04 (and 3 more hashes).
- [URL ] Malicious download pages hosting disguised executables – https[:]//chatgpt-30-10[.]netlify[.]app/ChatGpt[.]exe, https[:]//dazzling-genie-b16946[.]netlify[.]app/Browser%20Update[.]exe.
- [FQDN ] C2 and management domains – patolino[.]theworkpc[.]com, secondfloor[.]dynuddns[.]com (also lastdance.mysynology.net, masterpanel.webredirect.org).
- [File name ] Disguised installer names observed on download pages – ChatGpt.exe, Browser Update.exe (and other names like Notepad++.exe, 7-zip.exe used to masquerade installers).
Read more: https://asec.ahnlab.com/en/90968/