Xeno RAT Technical Analysis

This blog post comes from the Xeno RAT Technical Analysis report. If you want to download it as a PDF click here

Executive Summary

Xeno RAT, an open-source remote access tool introduced this year, has rapidly gained popularity in the cybersecurity community. Its ongoing development aims to compete with commercial RATs by providing a wide range of features at no cost. The user-friendly builder tool enables easy creation of client files, facilitating deployment across various campaigns.

In terms of functionality, Xeno RAT offers a comprehensive suite of tools for remote system management. It includes capabilities such as reverse proxy, detailed process, file, and registry management, catering to diverse user needs. The shell interface allows for convenient interaction, while the InfoGrab feature excels at extracting sensitive data like cookies, passwords, and credit card information, making it a valuable asset for cyber adversaries.

Furthermore, Xeno RAT emphasizes persistence, enabling attackers to establish a foothold on compromised systems through startup file creation. Its advanced bypass techniques for User Account Control (UAC) and Windows directory restrictions enhance its ability to evade system defenses and maintain access over time.

File Identification

Filename	Release.zip
Filetype	Compressed File
Written Language	–
MD5	89661a9ff6de529497fec56a112bf75e
SHA1	2dd31a19489f4d7c562b647f69117e31b894b5c3
SHA256	e7b275d70655db9cb43fa606bbe2e4f22478ca4962bbf9f299d66eda567d63cd
First Seen / Detection Date	2024-02-17
Initial Infection Vector

Filename	xeno rat server.exe
Filetype	PE32
Written Language	.NET
MD5	3987ee127f2a2cf8a29573d4e111a8e8
SHA1	fc253131e832297967f93190217f0ce403e38cb0
SHA256	3d00a800474ddf382212e003222805bd74665b69cec43b554f91c3cd9edf04c4
First Seen / Detection Date	2024-02-17
Initial Infection Vector

Filename	xeno rat client.exe
Filetype	PE32
Written Language	.NET
MD5	d23d8120af87a615a456a12b43d4a98a
SHA1	73b41123d6f50aecdcf1c5e87a7d0319d753b0e7
SHA256	27178a08e0d8fb6e5e31ae9bff6194a5224406666fa1f528d4719c1e4a8efd67
First Seen / Detection Date	2024-02-17
Initial Infection Vector

Filename	Sys.zip
Filetype	Compressed File
Written Language	–
MD5	6f9e84087cabbb9aaa7d8aba43a84dcf
SHA1	ae21b7a2eaa00f290280d8f8807e24db887af17f
SHA256	4d0d8c2696588ff74fe7d9f8c2097fddd665308fccf16ffea23b9741a261b1c0
First Seen / Detection Date	2024-02-17
Initial Infection Vector

MITRE ATTA&CK Threat Matrix

• TA002 Execution
  • T1204 User Execution
    • T1204.002 Malicious File
  • T1047 Windows Management Instrumentation
  • T1053 Scheduled Task/Job
    • T1053.005 Scheduled Task
• TA003 Persistence
  • T1547 Boot or Logon Autostart Execution
    • T1547.001 Registry Run Keys / Startup Folder
• TA005 Defense Evasion
  • T1140 Deobfuscate/Decode Files or Information
  • T1112 Modify Registry
• TA006 Credential Access
  • T1555 Credentials from Password Stores
    • T1555.003 Credentials from Web Browsers
  • T1539 Steal Web Session Cookie
• TA007 Discovery
  • T1012 Query Registry
  • T1033 System Owner/User Discovery
  • T1057 Process Discovery
  • T1082 System Information Discovery
  • T1083 File and Directory Discovery
  • T1087 Account Discovery
  • T1518 Software Discovery
    • T1518.001 Security Software Discovery
• TA007 Collection
  • T1056 Input Capture
• TA0040 Impact
  • T1529 System Shutdown/Reboot

Conclusion

Mitigation Strategies

Here are some general mitigation recommendations to protect against Xeno RAT:

• Monitor the existence of files in the directory %APPDATA%\Adobe\Drivers to detect any suspicious activities or files associated with Xeno RAT.
• Regularly inspect the contents of scheduled tasks on the system to identify any malicious tasks created by Xeno RAT or unauthorized tasks that could potentially be leveraged for malicious purposes.
• Exercise caution when encountering files that appear to be PNG images but are actually .lnk files. These files can run commands and download malicious files. They may be obfuscated or disguised to evade detection. Implement measures to identify and analyze such files for potential threats associated with Xeno RAT.

Implementing these recommendations can help minimize the risk of Xeno RAT and protect your organization from potential damage.

This blog post comes from the Xeno RAT Technical Analysis report. If you want to download it as a PDF click here