EdskManager RAT is a sophisticated remote access trojan that employs multi-stage infection, encrypted configuration files, and HVNC for stealthy remote control. It uses cloud-hosted malware components, dynamic C2 infrastructure, and advanced anti-analysis techniques to maintain persistence and evade detection. #EdskManagerRAT #HVNC #AmazonS3 #u_arpuu_com #kimhate_com
Keypoints
- EdskManager RAT uses a multi-stage infection process starting with a downloader disguised as legitimate software.
- The malware stores critical configuration data in an encrypted .edskv file decrypted in memory during execution.
- It communicates with its command-and-control servers using zlib-compressed messages over socket API and supports dynamic fallback domains.
- Utilizes Hidden Virtual Network Computing (HVNC) to enable stealthy remote control without visible signs on the victim’s screen.
- Persistence is established through scheduled tasks, autorun registry entries, and startup shortcuts.
- The malware performs system reconnaissance including browser extension enumeration and collects detailed host information.
- Implements multiple anti-analysis techniques such as memory obfuscation, API hooking, and debugger evasion.
MITRE Techniques
- [T1566] Phishing – Implied as initial access vector through deceptive downloader disguised as legitimate software.
- [T1189] Drive-by Compromise – Suggested as a method for delivering the initial downloader.
- [T1204] User Execution – The downloader relies on user interaction to execute the initial payload.
- [T1547.001] Registry Run Keys/Startup Folder – Persistence via autorun registry entries for malware execution at startup.
- [T1053.005] Scheduled Task – Persistence ensured by creating scheduled tasks that execute malware components.
- [T1622] Debugger Evasion – Use of anti-debugging techniques to avoid analysis (“…anti-analysis… memory-to-memory operations…”).
- [T1140] Deobfuscate/Decode Files or Information – Decrypts encrypted .edskv file contents in memory to obtain configurations.
- [T1564.003] Hidden Window – Creates multiple hidden windows to support stealth and remote control (HVNC functionality).
- [T1027.013] Encrypted/Encoded File – Uses encrypted .edskv files for storing configuration and critical data.
- [T1497] Virtualization/Sandbox Evasion – Uses memory obfuscation and runtime tactics to hinder sandbox detection.
- [T1082] System Information Discovery – Gathers detailed information about the host environment and installed software.
- [T1087.001] Local Account Discovery – Collects user and group information from the infected system.
- [T1010] Application Window Discovery – Detects and enumerates browser extensions and application windows.
- [T1217] Browser Information Discovery – Enumerates installed browser extensions on Chrome, Brave, and Edge.
- [T1007] System Service Discovery – Collects data related to system services to assist reconnaissance.
- [T1124] System Time Discovery – Likely used to maintain timing and avoid detection during execution.
- [T1673] Virtual Machine Discovery – Attempts to detect virtual environments for evasion.
- [T1115] Clipboard Data – Capability to monitor and capture clipboard contents.
- [T1005] Data from Local System – Collects local system data for exfiltration.
- [T1056] Input Capture – Includes keylogging functionality to capture user inputs silently.
- [T1113] Screen Capture – Ability to capture screenshots of the victim’s desktop.
- [T1041] Exfiltration Over C2 Channel – Data exfiltration is done via encrypted communication with C2 servers.
- [T1001] Data Obfuscation – Uses compression and encryption to obscure communication content sent to C2.
Indicators of Compromise
- [File] Initial downloader and malware components – WindowsFormsApp.exe (SHA-256: 85bae6fe73a9e2bf0819a6f60adfc458392a7a56de23f10d3bdddb8e3a97a8ec), commonbase.dll, LogManager.dll, VideoManagerEntry.edskv.
- [Domain] Command and control servers – u[.]arpuu[.]com (previously resolved to 56[.]155[.]36[.]99), kimhate[.]com:1516 (potential C2, no observed communication).
- [URL] Malware hosting location – videomanagerentry[.]s3[.]ap-northeast-1[.]amazonaws[.]com (Amazon S3 storage for downloading payload files).
- [Registry Key] Persistence mechanism – ComputerHKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRunVideoManagerEntry.
- [Scheduled Task] Persistence mechanism – Task named “VideoManagerEntry” created to maintain persistence.