People applying for US Visas in Switzerland have complained about receiving malware from an unknown person via Skype, who introduced himself to them as a US government official who regulates applications for the said process.
The victims report that the person sent them a file named “US Travel Docs Information.jar”, but what raised their suspicion was the fact that the Skype account contained a spelling error (ustravelidocs-switzerland, notice the extra “i”) and that this made them realize that it was not an official account.
F-Secure researchers investigated the case and announced that they found many such accounts, with misspellings in the names, targeting visa applicants in many other countries.
F -Secure says that when it analyzed the malicious Java file, it found it was infected with a malware they had never seen before, a RAT (Remote Access Trojan) that gave attackers access to the victim's computer.
Researchers named the malware Qarallax RAT because it connected to a C&C (command and control) server with an IP leading to the qarallax.com domain.
The organization that registered the domain was called QUAverse, which led researchers to believe that this malware is somehow related to the Quaverse RAT discovered in May 2015, also written in Java.
Taking a look at the RAT's inner workings, researchers found rebranded versions of the LaZagne password dumping application as well as some unique features.
These included the ability to capture mouse cursor movements, mouse clicks, keystrokes, take camera snapshots, or record video.
Just like the Quaverse RAT, the Qarallax RAT was also available for sale online. The price of the Qarallax ranges from $22 to $900, depending on the period for which the buyer wants to rent the service. It is worth noting that this is the normal price range for such services.
Because the tool is rented, it is not entirely accurate to say that the US VISA application campaign is the work of Arabic-speaking Turkish hackers, although indications in the Qarallax source code might lead you to believe so.
Showing interest in people who might want to leave a country sounds like something various oppressive governments would do, as they are known to purchase surveillance software.
