Cybercriminals Advertising Godzilla Loader Malware for $500 on Dark web forums, the malware found actively maintained and getting new updates periodically.
Godzilla modern downloader or dropper which first runs the binary on victim’s machine and then it downloads the payload form a remote server.
According to Checkpoint investigation, the Godzilla Loader malware rate of infection is very less when compared to its competitor, Emotet.
The Godzilla loader advertised as it comes with built-in UAC bypass, the User Account Control(UAC) is a Microsoft security tool that helps in preventing the intrusion of malicious software.
With the new version of “Godzilla, the author boasts that they have converted even more of the control flow to rely entirely on COM interfaces; persistence is achieved via the IPresistFile interface and shell executions of programs on the local disk are triggered via the IShellDispatch interface,” reads Checkpoint blog post.
It also performs other functions such as deletion of file backup, the only possible reason for it to be the anti-Ransomware measure which operates by recovering the original files from the shadow file backups.
The threat actors offered a bouble-layered fail-safe for C&C communication and employs RSA-2048 to verify the identity of the C&C server.
Last version of the malware appears to be under development from last December, the latest version contains propagation module, keylogger module and password stealing module.
Based on it’s existence and adoption rate, researchers said it could be a good example for the principle of the Long Tail.
Related Read:
Dark Web Market Silk Road Admin Pleads Guilty, Prison Up to 20 Years
