Xeno RAT: A New Remote Access Trojan with Advance Capabilities – CYFIRMA

MITRE Techniques

• [T1059.003] Windows Command Shell – The lnk downloader uses the Windows command shell to retrieve, extract, and execute the payload from a zip archive. Quote: [‘The Windows command shell to retrieve, extract, and execute the payload from a zip archive, located at the Discord CDN URL.’]
• [T1053.005] Scheduled Task – Malware adds itself as scheduled task for persistence. Quote: [‘Malware adds itself as scheduled task for persistence.’]
• [T1204.001] Malicious Link – Primary vector is a shortcut file disguised as a WhatsApp screenshot acting as downloader. Quote: [‘The primary vector in the form of a shortcut file, disguised as a WhatsApp screenshot, acts as downloader.’]
• [T1024.002] Malicious File – Zip archive contains multiple files including executable and DLL. Quote: [‘The zip archive contains three files, two portable executable (exe and DLL) files and one unknown file named as ‘LICENSE’.’]
• [T1053.005] Scheduled Task – (Reinforced) Persistence through scheduled task. Quote: [‘Malware adds itself as scheduled task for persistence.’]
• [T1622] Debugger Evasion – Uses anti-debugging/evasion techniques. Quote: [‘Utilizes anti-debugging techniques and follows a stealth operation process.’]
• [T1497] Virtualization/Sandbox Evasion – Evades analysis via virtualization/sandbox evasion. Quote: [‘…Virtualization/Sandbox Evasion’]
• [T1055] Process Injection – Injects into legitimate Windows processes (hh.exe, colorcpl.exe). Quote: [‘process injection’]
• [T1622] Debugger Evasion – (Discovery context) Debugger/analysis evasion behaviors observed. Quote: [‘Debugger Evasion’]
• [T1071.001] Web Protocols – C2 communications over obfuscated network traffic. Quote: [‘Web Protocols’]
• [T1574.001] DLL Search Order Hijacking – Loads malicious samcli.dll by abusing DLL search order. Quote: [‘DLL search order functionality of the Windows operating system by positioning the malicious DLL with the same name in the current working directory.’]