Abyssos: Technical Analysis of a New Modular RAT

MITRE Techniques

• [T1497.001] System Checks – Abyssos checks for virtualization by using CPUID to detect VMware, KVM, Xen, and VirtualBox and exits if found (‘detect the presence of hypervisors… If it detects any of these, Abyssos terminates execution’).
• [T1497.002] User Activity Based Checks – Abyssos looks for specific analysis-related processes and terminates when they are running (‘Checks for the following process names and exits if any are running: vmtoolsd.exe … VBoxTray.exe …’).
• [T1027] Obfuscated Files or Information – Abyssos applies multiple obfuscation passes to hinder reverse engineering (‘Control flow flattening’, ‘Bogus control flow’, ‘Constant integer encryption’, ‘Stack-based string obfuscation’).
• [T1027.013] Encrypted/Encoded File – Abyssos encrypts network data and some modules with AES-GCM, AES-CBC, or XOR (‘Abyssos primarily uses AES in GCM mode… the encrypted Abyssos modules… AES-CBC … or using a bitwise XOR operation’).
• [T1090.001] Internal Proxy – Abyssos uses VNC and browser/CDP-based relaying to control compromised systems and interact with sessions (‘Starts a VNC session’, ‘connects to it (using the WebSocket protocol) and sets the cookies’).
• [T1105] Ingress Tool Transfer – Abyssos downloads additional modules and files from the C2 server (‘downloads additional modules from the command-and-control (C2) server’, ‘FM_PUT downloads a file from the C2 server on to the host’).
• [T1041] Exfiltration Over C2 Channel – Abyssos sends stolen files, browser data, and module output back to the C2 server (‘uploads a specified file from the compromised host to the C2’, ‘sends the resulting output to the C2 server’).
• [T1056.001] Keylogging – Abyssos includes a keylogger module and stores captured keystrokes in a temporary file (‘KEYLOGGER_GETLOGS… reads the captured keystrokes obtained from the keylogger’).
• [T1115] Clipboard Data – Abyssos starts a thread to intercept clipboard data (‘CLIPBOARD_START starts a thread that intercepts clipboard data every second’).
• [T1010] Application Window Discovery – Abyssos leverages VNC and GUI control of applications and browser sessions (‘HVNC_START’, ‘HVNC_INPUT’, ‘HVNC_PROG’).
• [T1548.002] Bypass User Account Control – Abyssos includes UAC bypass commands via Windows fodhelper and ICMLuaUtil (‘UAC_BYPASS_FODHELPER’, ‘UAC_BYPASS_ICMLUAUTIL’).
• [T1136.001] Local Account – Abyssos creates a mutex using the current user context and distinguishes admin/user state (‘append either the string _Admin or _User’).
• [T1036] Masquerading – Abyssos uses deceptive filenames and locations such as update-like cache names and temporary-folder modules (‘windows_update_cache.json’, ‘datascan.png’).
• [T1070.004] File Deletion – Abyssos deletes downloaded files after execution and can self-delete (‘The downloaded file is deleted after it has been executed’, ‘SELF_DELETE’).
• [T1057] Process Discovery – Abyssos enumerates running processes and collects their details (‘Collects information about the system’s running processes’).
• [T1016] System Network Configuration Discovery – Abyssos gathers public IP, country code, DNS-related info, and network connections (‘Public IP’, ‘country code’, ‘PF_START’).
• [T1082] System Information Discovery – Abyssos collects host details including username, computer name, OS version, CPU architecture, RAM, GPU, and uptime (‘Collects host information such as the CPU architecture, computer name, username’).
• [T1053.005] Scheduled Task/Job: Scheduled Task – Abyssos uses recurring threads for periodic actions like polling C2, clipboard capture, and process/network monitoring (‘every few seconds’, ‘every 3 seconds’, ‘every 2 seconds’).