Fruity Trojan Uses Deceptive Software Installers to Spread Remcos RAT

Share:

Threat actors are creating fake websites hosting trojanized software installers to trick unsuspecting users into downloading a downloader malware called Fruity with the goal of installing remote trojans tools like Remcos RAT.

Among the software in question are various instruments for fine-tuning CPUs, graphic cards, and BIOS; PC hardware-monitoring tools; and some other apps, cybersecurity vendor Doctor Web said in an analysis.

Such installers are used as a decoy and contain not only the software potential victims are interested in, but also the trojan itself with all its components.

The exact initial access vector used in the campaign is unclear but it could potentially range from phishing to drive-by downloads to malicious ads. Users who land on the fake site are prompted to download a ZIP installer package.

The installer, besides activating the standard installation process, stealthily drops the Fruity trojan, a Python-based malware that unpacks an MP3 file (Idea.mp3) to load an image file (Fruit.png) to activate the multi-stage infection.

This image file uses the steganography method to hide two executables (.dll libraries) and the shellcode for the next-stage initialization inside it, Doctor Web said.

Fruity is also designed to bypass antivirus detection on the compromised host and ultimately launch the Remcos RAT payload using a technique called process doppelgänging.

That said, the attack sequence could be exploited to distribute all kinds of malware, which makes it imperative that users stick to downloading software only from trustworthy sources.

The development comes as Bitdfender disclosed details of a malspam campaign delivering the Agent Tesla malware to harvest sensitive data from compromised endpoints.

It also follows a surge in malvertising operations that have targeted customers and businesses with tainted software boosted via ads on search engines.

This includes a new wave of attacks dubbed Nitrogen in which fraudulent ISO archives are distributed using bogus ads that impersonate download pages for applications such as AnyDesk, WinSCP, Cisco AnyConnect, Slack, and TreeSize.

This malvertising campaign leads to the propagation of the infection after initial exposure, Bitdefender researchers Victor Vrabie and Alexandru Maximciuc said.

For as long as they dwell in the victim’s network, the attackers’ primary goal is to obtain credentials, set up persistence on important systems and exfiltrate data, with extortion as the end goal.

 

(c) Thin

Leave a Comment

Your email address will not be published. Required fields are marked *

loader-image
London, GB
10:27 pm, Jul 7, 2025
weather icon 17°C
L: 16° | H: 18°
broken clouds
Humidity: 62 %
Pressure: 1014 mb
Wind: 14 mph WNW
Wind Gust: 0 mph
UV Index: 0
Precipitation: 0 mm
Clouds: 70%
Rain Chance: 0%
Visibility: 10 km
Sunrise: 4:52 am
Sunset: 9:18 pm
DailyHourly
Daily ForecastHourly Forecast
Tomorrow 10:00 pm
weather icon
16° | 18°°C 0.34 mm 34% 11 mph 77 % 1019 mb 0 mm/h
Wed Jul 09 10:00 pm
weather icon
15° | 26°°C 0.2 mm 20% 7 mph 65 % 1022 mb 0 mm/h
Thu Jul 10 10:00 pm
weather icon
19° | 31°°C 0 mm 0% 6 mph 74 % 1023 mb 0 mm/h
Fri Jul 11 10:00 pm
weather icon
20° | 31°°C 0 mm 0% 10 mph 66 % 1022 mb 0 mm/h
Sat Jul 12 10:00 pm
weather icon
19° | 29°°C 0 mm 0% 10 mph 70 % 1020 mb 0 mm/h
Tomorrow 1:00 am
weather icon
14° | 16°°C 0.2 mm 20% 11 mph 65 % 1014 mb 0 mm/h
Tomorrow 4:00 am
weather icon
11° | 13°°C 0.34 mm 34% 11 mph 77 % 1015 mb 0 mm/h
Tomorrow 7:00 am
weather icon
13° | 13°°C 0 mm 0% 10 mph 69 % 1016 mb 0 mm/h
Tomorrow 10:00 am
weather icon
18° | 18°°C 0 mm 0% 9 mph 47 % 1017 mb 0 mm/h
Tomorrow 1:00 pm
weather icon
23° | 23°°C 0 mm 0% 8 mph 33 % 1018 mb 0 mm/h
Tomorrow 4:00 pm
weather icon
24° | 24°°C 0 mm 0% 7 mph 29 % 1017 mb 0 mm/h
Tomorrow 7:00 pm
weather icon
24° | 24°°C 0 mm 0% 7 mph 29 % 1017 mb 0 mm/h
Tomorrow 10:00 pm
weather icon
20° | 20°°C 0 mm 0% 5 mph 41 % 1019 mb 0 mm/h
Name Price24H (%)
Bitcoin(BTC)
€91,982.36
-1.22%
Ethereum(ETH)
€2,155.96
-1.57%
Tether(USDT)
€0.85
-0.01%
XRP(XRP)
€1.94
-0.60%
Solana(SOL)
€126.39
-2.84%
USDC(USDC)
€0.85
0.00%
Dogecoin(DOGE)
€0.141939
-3.08%
Shiba Inu(SHIB)
€0.000010
-2.99%
Pepe(PEPE)
€0.000009
-3.96%
Scroll to Top