Several types of cyber attacks have been seen targeting the remote collaboration app Zoom, as work from home brings a surge in active installations. Earlier, coinminers have also been bundled with the Zoom installer. Recently, another campaign was reported that bundles the WebMonitor RAT with the Zoom Installer. Note that although the installers are legitimate, the ones bundled with malware do not come from official sources of the Zoom app like Zoom’s own download center or legitimate app stores such as the Apple App Store and Google Play Store. They instead come from malicious sources. We also note that the Zoom app has been updated to version 5.0.cybercriminals may have repackaged the legitimate installers with WebMonitor RAT and released these repackaged installers in malicious sites.When running the ZoomInstaller.exe, it drops a copy of itself named Zoom.exe. ZoomInstaller.exe will then open the process notepad.exe to run Zoom.exe.
The backdoor connects to the URL dabmaster[.]wm01[.]to and executes commands from a remote malicious user, some of which are listed below (for the full list, please refer to our malware report):
It terminates itself when executed in the following virtual environments:
It also terminates itself if it finds a file name similar to any of the following:
Since the system downloaded a legitimate Zoom application version (4.6), it won’t make the users suspicious.