DarkComer RAT disguised as Skype encryption software

A while ago, Syrian dissidents claimed that the government uses malware to spy on them.

The malware was delivered through compromised email accounts of other opposition members, or via online chats that they believe they are having with a fellow dissident, but are actually having with a government agent who hijacked the account.

Now Trend Micro researchers have discovered another way that the Syrian government tries to install backdoors into its opponents’ computers.

“We discovered a webpage that advertises a software that purports to provide encryption for Skype,” say the researchers. “This page is hosted in Syria on {BLOCKED}encription.sytes.net, which resolves to {BLOCKED}.{BLOCKED}.0.28 – the same server that acted as a command-and-control server for previous attacks. The webpage features an embedded YouTube video that claims to be from ‘IT Security Lab’ and to encrypt voice communications.”

When downloaded and run, the offered software looks pretty legitimate – even though the version stated on the software does not correspond with the one stated in the offered file (Skype Encription v 2.1.exe):

Unfortunately for those who did so, the software is actually a backdoor Trojan that immediately contacts the aforementioned C&C server and downloads the DarkComet RAT, whose capabilities include keystroke logging, file system access and remote control, and control of devices such as microphones and webcams