STX RAT: A new RAT in 2026 with Infostealer Capabilities

MITRE Techniques

• [T1195 ] Supply Chain Compromise – Malware distributed via trojanized legitimate installers: (‘A fake FileZilla site hosts a malicious download’ / ‘trojanized FileZilla installers’).
• [T1204.002 ] User Execution: Malicious File – Initial delivery via a browser-downloaded VBScript/JScript executed by WScript: (‘attempted delivery of the malware via a browser-downloaded VBScript file’ and ‘”C:WindowsSystem32wscript.exe” “C:UsersAppDataLocalTempbusiness-structure.xlsx.js” /elevated’).
• [T1059.001 ] Command and Scripting Interpreter: PowerShell – In-memory loader and fileless execution using PowerShell STDIN/Invoke-Expression: (‘powershell.exe -Command “[Console]::In.ReadToEnd() | Invoke-Expression”‘).
• [T1059.005 ] Command and Scripting Interpreter: JScript/JavaScript – JScript staged downloader executed via WScript to retrieve and unpack subsequent stages: (‘The JScript file’s contents … download a TAR file, extract it to disk, and execute the next stage PowerShell loader.’).
• [T1055.001 ] Process Injection / Reflective DLL Loading – Payloads are loaded into RWX memory, copied via WriteProcessMemory/CreateThread/reflective techniques and executed in-memory: (‘allocates RWE memory … copies the payload … and transfers execution’ / ‘dll reflective injection’).
• [T1219 ] Remote Services – Hidden VNC (HVNC) remote desktop capability allowing operator control via hidden desktops and input injection: (‘HVNC / hidden remote desktop functionality’ and ‘Hidden remote desktop allowing threat actors to control victim’s machine’).
• [T1547.001 ] Boot or Logon Autostart Execution: Registry Run Keys – Persistence via HKCU Run entries launching autorun.ps1 and MSBuild-based projects: (‘HKCU Run entry launches a PowerShell script (autorun.ps1)’ and ‘HKCU Run entry launches MSBuild.exe … containing C# code …’).
• [T1546 ] Hijack Execution Flow / Scriptlet/COM Hijacking – Persistence via COM object hijacking using a scriptlet (ActiveX.sct) registered under a TypeLib key to launch the autorun scriptlet: (‘COM object hijacking using a scriptlet: the registry key’s (Default) value is set to script:C:pathtoActiveX.sct’).
• [T1113 ] Screen Capture – Malware captures a screenshot via BitBlt/GDI before exfiltrating it to the C2 as base64 JPG when harvesting credentials: (‘the malware creates a screenshot of the victim desktop via BitBlt/GDI functions, and transmits it to the C2 as a base64 encoded JPG file’).
• [T1555 ] Credentials from Password Stores – Broad stealer functionality targeting Chromium/Firefox browser credentials, Windows Vault, FTP clients, and desktop crypto wallets: (‘Firefox/SeaMonkey browser cookies and passwords’ / ‘Windows Vault credentials via Windows APIs’ / ‘Desktop-based crypto-wallets: Electrum, Bitcoin-Qt, etc.’).
• [T1497 ] Virtualization/Sandbox Evasion – Anti-VM and sandbox checks for virtualization artifacts and registry keys/files/services to jitter-exit on detection: (‘scanning for a broad set of virtualization artifacts and terminating on detection, with randomized sleep delays’).
• [T1562.001 ] Impair Defenses: Disable or Modify Tools – AMSI Ghosting by patching rpcrt4!NdrClientCall3 to impede AMSI telemetry: (‘uses a known AMSI (Anti-Malware Scan Interface) -bypass technique called AMSI Ghosting, where it patches the Windows API rpcrt4!NdrClientCall3’).
• [T1573 ] Encrypted Channel – C2 channel confidentiality and integrity provided by X25519 ECDH, Ed25519 signature verification, HKDF-SHA256, and ChaCha20-Poly1305: (‘X25519 ECDH derives a per-session shared secret’ / ‘Session traffic is encrypted and integrity-protected with ChaCha20-Poly1305’).
• [T1027 ] Obfuscated Files or Information – String and import obfuscation including rolling XOR, AES-128-CTR encrypted strings, and salted SHA-1 API/module hashing to hinder static analysis: (‘strings stored throughout the binary are rolling XOR-encoded and AES-128-CTR-encrypted’ and ‘resolves Windows APIs and module dependencies using salted SHA-1 hashes’).