STX RAT Malware

**STX RAT** is a Remote Access Trojan documented by eSentire and Kaspersky researchers, active since at least July 2025. It is the payload used in the CPUID HWMonitor Supply Chain Attack (April 2026) and the earlier **FileZilla campaign**, both attributed to the same actor. ## Architecture ### Delivery - **Inno Setup installer** (Russian-language dialogs) — drops two components: - A legitimate-looking host binary (signed, benign on its own) - A malicious `CRYPTBASE.dll` in the same directory - **DLL sideloading**: the legitimate binary loads `CRYPTBASE.dll` from its own directory; Windows DLL search order ensures the malicious local copy loads before any system DLL. ### Unusual: Zig-compiled DLL `CRYPTBASE.dll` is compiled with Zig — unusual enough to be a distinctive signature. Zig is a systems programming language (alternative to C / C++) with explicit cross-compilation support and small runtime footprint. Malware authors usually prefer C/C++ or .NET; Zig choice suggests: - Author has modern systems-programming skills. - Cross-platform build environment. - Possibly deliberate attempt to evade signature detection (less common language = less common patterns in AV training data). ### Execution chain 1. Malicious DLL loads, establishes NTDLL function proxying via a .NET assembly. 2. **NTDLL proxying** routes Windows API calls through the .NET runtime, complicating dynamic analysis (API calls look like .NET activity, not raw Win32). 3. **5-stage in-memory attack chain**: - Stage 1: anti-analysis checks (debugger, sandbox, VM detection) - Stage 2: environment reconnaissance - Stage 3: persistence installation - Stage 4: payload decryption - Stage 5: C2 contact and password theft 4. **MSBuild persistence**: launches from `MSBuild.exe`, a legitimate Windows build tool, to evade signature-based persistence monitoring. 5. **IPv6-encoded .NET deserialization**: payload delivery encoded as IPv6 addresses, bypassing URL-based network signatures. ### C2 - Fixed IP: **95.216.51.236** - Port: **31415** (digits of pi — possibly deliberate, distinctive) - Staging domain: `welcome.supp0v3.com` (registered Oct 29, 2025 via CNOBIN Hong Kong registrar) - Related domain: `rnetopera.org` (plausible Opera browser impersonation for future campaign) - Hosting: offshore Caribbean infrastructure, complicating takedowns ## Primary objective: Chrome password theft STX RAT's main payload targets Google Chrome saved passwords. Technique: 1. Use the **IElevation COM interface** — a legitimate Windows mechanism Chrome uses for its own updater, which has elevated privileges. 2. Invoke Chrome's own password-decryption routine via this interface. 3. Extract plaintext saved passwords without needing the user's Windows login password or Chrome master password. This is the 'sophisticated' bit of the attack — most password stealers brute-force or extract encrypted blobs for offline cracking. STX RAT uses Chrome's own legitimate infrastructure against it. ## Attribution history - **July 2025**: earliest known C2 sample (`superbad.exe`) communicating with 95.216.51.236:31415. - **October 2025**: staging domain `welcome.supp0v3.com` registered. - **Late 2025 / early 2026**: FileZilla supply chain campaign — trojanized FileZilla installers distributed via compromised distribution sites. - **April 9-10, 2026**: CPUID HWMonitor Supply Chain Attack (April 2026). Shared indicators across these: - Same C2 infrastructure - Same DLL sideloading + NTDLL proxying technique - Same Russian-language Inno Setup installer dialogs - Same IElevation Chrome-password extraction payload ## Detection and mitigation - Network: block 95.216.51.236:31415 at firewall; look for IPv6 traffic from unusual processes. - Endpoint: look for `CRYPTBASE.dll` in user-writable directories (should only exist in System32). - Process monitoring: legitimate MSBuild.exe launches during software development; unexpected MSBuild invocations on consumer machines are suspicious. - Chrome: if suspected compromise, change all saved passwords; consider switching to external password manager (Bitwarden, 1Password) with hardware 2FA. ## Threat actor profile - Russian-speaking (dialogs, language). Could be misdirection — Russian-language artifacts are cheap to fake. - Likely financially motivated, potentially an initial access broker reselling compromised endpoints. - Kaspersky assessed OPSEC as **low**: caught quickly, multiple identification clues left behind. - Multi-jurisdictional infrastructure (Russian language, Hong Kong registrar, Caribbean hosting, Cloudflare US distribution) complicates prosecution — a pattern typical of 2020s cybercrime tradecraft. ## Related - CPUID HWMonitor Supply Chain Attack (April 2026) — the most recent STX RAT campaign. - CVE-2024-38475 — the Apache mod_rewrite vulnerability used for initial access in the CPUID case.