MostereRAT Deployed AnyDesk/TightVNC for Covert Full Access

FortiGuard Labs identified a phishing campaign targeting Japanese users that deploys a multi-stage Remote Access Trojan called MostereRAT, which leverages Easy Programming Language (EPL), service and scheduled task persistence, and deployment of legitimate remote-access tools to achieve full system control. The malware uses advanced evasion including AV/EDR traffic blocking via Windows Filtering Platform, running as TrustedInstaller, and mTLS-protected C2 communications. #MostereRAT #EPL

Keypoints

Phishing emails lure Japanese users to download a Word document that contains an embedded ZIP archive and a single instruction to run the contained executable.
The initial executable (document.exe) decrypts bundled tools with a simple SUB operation and places components under C:ProgramDataWindows before creating stealthy services and scheduled tasks for persistence.
One stage of the malware is written in Easy Programming Language (EPL) and uses EPK files and an EPK launcher (krnln.fnr) to load modules in memory.
MostereRAT can escalate to TrustedInstaller by duplicating tokens (SeDebugPrivilege) and launching processes with full system privileges (code reused from NSudo).
The malware contains lists of AV product paths and names, creates WFP filters to block security product network traffic, and explicitly terminates or disables Windows update/security services and files.
Command-and-control supports HTTP ports 9001/9002 for upgrades and mTLS over TCP port 8000 for a rich C2 protocol with a magic number, versioning, and up to 37 commands to run EPK/DLL/EXE/shellcode, deploy AnyDesk/TightVNC/Xray, and manage users and RDP settings.
IOCs include numerous C2 domains and a long SHA-256 file hash; Fortinet detections and protections (FortiGuard AV, CDR, IP Reputation, FortiGate/FortiClient/FortiEDR) block the threat.

MITRE Techniques

[T1566] Phishing – Initial access via phishing emails crafted for Japanese users to click malicious links and download an infected Word document (“phishing emails designed to lure Japanese users into clicking on malicious links”).
[T1204] User Execution – Victim instructed to open embedded archive and run contained file (“open an embedded archive and run the only file it contains”).
[T1105] Ingress Tool Transfer – Downloads additional payloads from C2 (ports 9001/9002) and via libcurl from specified URLs (“downloaded payload is verified using a SHA-256 hash before the new version is executed”).
[T1543] Create or Modify System Process – Creates services like “WpnCoreSvc” and “WinSvc_” using a custom RPC client that interacts with the SCM, bypassing standard APIs (“CreateSvcRpc…communicates with the ntsvcs named pipe to interact with the Windows Service Control Manager… resulting service runs with SYSTEM-level privileges”).
[T1053] Scheduled Task – Registers scheduled jobs ‘MicrosoftWindowswinrshost’ and ‘MicrosoftWindowswinresume’ for persistence (“XML file defining the scheduled jobs is loaded from resources. It registers the jobs…”).
[T1086] PowerShell / Scripting – Uses EPL runtime and EPK launcher to execute compiled EPL modules and calls exported functions like getVersion (“execution starts by obtaining command-line arguments… LoadEPKFromCmdLine in krnln.fnr”).
[T1134] Access Token Manipulation – Enables SeDebugPrivilege, duplicates SYSTEM and TrustedInstaller tokens, and launches processes as TrustedInstaller (“enables SeDebugPrivilege and duplicates its own process token… then starts the TrustedInstaller service and duplicates its token”).
[T1499] Endpoint Denial of Service / Disable Security Tools – Terminates security processes, stops services, deletes system files, and removes scheduled tasks to disable Windows security features (“terminates processes such as ‘SecurityHealthService.exe’… deletes ‘WaaSMedicSvc.dll’ and ‘wuaueng.dll’”).
[T1573] Encrypted Channel / T1573.001 (mTLS) – Uses mutual TLS with embedded client key/cert and CA cert for C2 communication (“communication is secured through mutual TLS (mTLS), utilizing an embedded client key, client certificate, and CA certificate”).
[T1090] Proxy – Deploys and runs remote access/proxy tools (AnyDesk, Xray, TightVNC) to enable attacker control (“Load configuration from resources and launch TightVNC, Xray… launch AnyDesk”).
[T1106] Native API – Bypasses standard service creation APIs using a custom RPC client that uses the ntsvcs named pipe (“CreateSvcRpc…directly communicates with the ntsvcs named pipe… bypassing standard APIs such as OpenSCManager, CreateService”).
[T1497] Virtualization/Sandbox Evasion – Uses EPL compiled format, in-memory loading, and custom launchers to hide behavior and evade analysis (“EPK launcher… module is then loaded into memory and its exported function ‘getVersion’ is called”).
[T1027] Obfuscated Files or Information – Encrypts bundled toolset and modules using a SUB operation before decryption at runtime (“data is decrypted using a simple SUB operation with the key value of ‘A’”).
[T1071] Application Layer Protocol – C2 uses HTTP on custom ports (9001/9002) for configuration and payload retrieval (“http://{C2 Domain}:9001/9001.conf http://{C2 Domain}:9002/9002.conf”).

Indicators of Compromise

[Domain ] C2 and malicious download domains used in campaign – www.efu66.comm, mostere.com, huanyu3333.com (and several other obfuscated/concatenated domains listed in article).
[File Hash ] Payload SHA-256 – d281e41521ea88f9… (long SHA-256 hash provided in article).
[File Name ] Suspicious file names used by stages – document.exe (initial drop), svchost.exe (malicious EPK), svchost.db, maindll.db, elsedll.db.
[Registry ] Persistence/hiding artifacts – HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogonSpecialAccountsUserList entry ‘V’ added to hide account (used to hide created admin account).
[Service/Task ] Created persistence artifacts – Services “WpnCoreSvc”, “WinSvc_”, and scheduled tasks ‘MicrosoftWindowswinrshost’ and ‘MicrosoftWindowswinresume’.

SHARE THIS STORY

WhatsApp X (Twitter)Telegram Bluesky Facebook LinkedIn Threads Email Print