xRAT
summary
xRAT is a mobile surveillanceware family that exfiltrates contacts, WeChat and QQ databases, photos and passwords and implements do_intruder HTTP fuzzing, do_portmap proxying and do_repeat web-response relay. Analysis shows three config-based versions: plaintext early builds, DES double base64 keys in strain.xml for ~92% of samples, and a 5% “version 3” with multiple AES keys and cantata/base assets. Samples span 2014–2019 with a May 2019 APK, 45 C2 commands, emulator and AV checks, self‑destruct cleanup and C2 servers frequently hosted in Hong Kong.
AI-written summary · about
chapters (15)
- 0:00Introduction to xRAT
- 1:11Overview of xRAT malware
- 3:17Comparison with Accessor M RAT
- 6:05xRAT technical evolution
- 12:14xRAT versions and configurations
- 15:06Anti-analysis mechanisms in xRAT
- 17:56Configuration file analysis
- 20:49Command and control communication
- 21:30New surveillance commands explained
- 31:38Purpose of new commands
- 36:18Client-server communication protocol
- 38:45Context and attribution of xRAT
- 42:17Application titles and targeting
- 45:52Lion Travel targeting case study
- 46:14Summary and future implications
related talks
17mRadRAT: An all-in-one toolkit for complex espionage ops
18mSchrödinger’s RAT: Profiling Stakeholders in the Remote Access Trojan Ecosystem
26mTracking the World's Dumbest Cyber Mercenaries
42mThe Next Gen PlugX/ShadowPad? A Dive into the Emerging China-Nexus Modular Trojan, Pangolin8RAT
33mOperation GamblingPuppet: Analysis of a Multivector and Multiplatform Campaign Targeting Online ...
56mCybersecurity & Privacy From The Global Lens
31mHacking People’s Mind: When Threat Actors Master Social Engineering
48mA Practical Attack Against VDI Solutions