AI Waifu RAT LLM Enabled Backdoor for Remote Code Execution

MITRE Techniques

• [T1566] Phishing – The malware was distributed through community posts and social engineering posing as a desirable research project (“…presented themself as a helpful ‘CTF player’ and ‘technical researcher’…”).
• [T1204.002] Malicious File – Users were asked to run executable files presented as features (“the ‘malicious file’ is disguised as a desirable software enhancement”).
• [T1036] Masquerading – The author disguised malicious binaries as legitimate “CTF Challenge” and “AI character” artifacts (“This so-called ‘CTF Challenge’ is essentially a disguised malicious program / scareware / stager”).
• [T1071.001] Web Protocols – The agent accepts plaintext HTTP requests from the LLM/web UI to the local C2 endpoints (“commands…sent to the local agent as plaintext HTTP requests”).
• [T1059.001] PowerShell – /execute_trusted spawns powershell.exe via popen to run attacker-supplied commands (“spawning a powershell.exe process via popen for execution”).
• [T1005] Data from Local System – The /readfile endpoint reads arbitrary local files and returns contents to C2 (“uses its path field as a file path argument, and reads the file’s contents…sending it back to the C&C source”).
• [T1041] Exfiltration Over C2 Channel – Read file contents are sent back to the C2 over the agent channel (“sending it back to the C&C source”).
• [T1562.001] Disable or Modify Tools – The author instructs users to whitelist or disable antivirus to avoid detection (“If your antivirus flags this, add it to the whitelist or turn it off temporarily”).
• [T1059.007] JavaScript – Prior web-based components executed untrusted LLM-generated code using eval/new Function(), creating remote code execution on the page (“directly execute LLM-generated code in the frontend JavaScript using an eval()-like new Function()”).
• [T1547.001] Registry Run Keys / Startup Folder – The challenge writes a Run key for persistence (FakeUpdater) (“writing to the registry to establish persistence…FakeUpdater register key”).
• [T1673] Virtual Machine Discovery – The binary queries SystemProductName to detect virtual machine environments (“extract the SystemProductName field from the registry … to check for strings from well-known virtual machine vendors”).
• [T1622] Debugger Evasion – The program uses checks like NtQueryInformationProcess, CheckRemoteDebuggerPresent, IsDebuggerPresent, and PEB->BeingDebugged (“classic, entry-level debugger detection methods…CheckRemoteDebuggerPresent and IsDebuggerPresent”).
• [T1497.001] System Checks – Uses timing checks and window enumeration to detect analyst environments (“enumerating window class names, and using simple timing checks based on Windows API calls”).
• [T1529] System Shutdown/Reboot – Malicious branch calls system() to forcibly shut down the user’s computer on consecutive wrong answers (“program immediately calls a system API to execute a shutdown command”).
• [T1207.009] Embedded Payloads – The challenge contains hardcoded Metasploit reverse TCP shellcode embedded and executed (“fills it with hardcoded metasploit shellcode, then jumps to the shellcode, which is a classic reverse TCP shellcode”).
• [T1620] Reflective Code Loading – The shellcode receives and executes a second-stage payload over a local socket (“listens on 127.0.0.1:4444 and receives the second stage payload through the socket and then executes it”).
• [T1027.015] Compression – Actors distributed payloads inside compressed/encrypted archives to evade hash detection (“bypass hash-based detection…Compression”).
• [T1027.013] Encrypted/Encoded File – Use of encrypted/encoded files and passwords for delivered archives (“file passwords listed for delivered archives”).
• [T1027.004] Compile After Delivery – Actors planned to deliver source and compile later to change behavior post-delivery (“Compile After Delivery (T1027.004: Compile After Delivery)”).
• [T1027.003] Steganography – Actors attempted additional evasion via steganography (“attempted further evasion using steganography”).
• [T1608.001] Upload Malware – Actors intended to host files on decentralized storage (IPFS) to resist takedown (“plan to further host the malicious files on the InterPlanetary File System (IPFS)”).