Security researchers have discovered a new modular remote access trojan called Abyssos, an advanced C++ malware family that grants attackers extensive control over infected Windows systems This article explores abyssos advanced malware. . The malware is actively being developed, with researchers tracking multiple versions and employing various code obfuscation techniques.
Its feature set includes remote shell access, hidden VNC sessions, file theft, browser-data collection, process control, keylogging support, and the ability to download additional modules from its command-and-control (C2) server. Once an attacker gains access to a target system, the RAT can collect host data, execute commands, move files, monitor activity, and expand its capabilities using encrypted plugins. Early samples check for virtualized environments by utilizing the CPUID instruction to identify hypervisors such as VMware, KVM, Xen, and VirtualBox.
Techniques used include control-flow flattening, bogus control flow, encrypted integer constants, and stack-based string obfuscation. Before executing its primary functions, Abyssos dynamically resolves Windows API calls by calculating CRC32 hashes for exported functions. The malware connects to its C2 server and registers the compromised device, gathering information such as the computer's name, username, CPU architecture, privilege level, public IP address, country code, and internal version number.
Commands like HVNC_START enable operators to create remote desktop sessions, while HVNC_INPUT simulates keyboard and mouse activity.
