Distribution of Malware Abusing LogMeIn and PDQ Connect

AhnLab ASEC identified attacks in which threat actors used fake download pages to distribute installers for LogMeIn Resolve and PDQ Connect that register attacker-controlled CompanyId values; those RMM tools were then used to execute PowerShell and install PatoRAT, a Delphi backdoor with remote control, HVNC, keylogging and credential-theft capabilities. The report documents PatoRAT's 1-byte XOR RC_DATA "APPCONFIG" format, sample clientTags, supported commands, observed CompanyId values, MD5 hashes, malicious URLs/FQDNs, and advises validating download sources, certificates, and keeping systems and security products updated.