Stealthy New Trojan SeroXen RAT Bypasses Antiviruses and Gives Hackers Full Access to Targeted Computers

Introduction In the vast landscape of cyber threats, a new remote access Trojan has emerged, posing a significant risk to individuals and organizations alike. AT&T, a leading telecommunications company, has recently uncovered a malware strain known as SeroXen RAT. This remote access Trojan has gained immense popularity among cybercriminals due to its high stealth capabilities and powerful features. In this article, we will delve into the details surrounding SeroXen RAT, exploring its origins, distribution methods, technical aspects, and the potential implications it holds for its victims.

2023-06-03 10:53:23 - admin

The Emergence of SeroXen RAT

SeroXen RAT has swiftly gained notoriety within the cybercriminal community. Initially marketed as a legitimate program for remote control of computers running Windows 10 and 11, it is priced at an astonishingly low rate of $15 per month or $60 for a "lifetime" license. However, investigations by the cyber-intelligence platform Flare Systems have revealed that SeroXen is being advertised on hacker forums as a remote access Trojan. The identity of those promoting the Trojan remains uncertain, leaving open the possibility of fraudulent actors exploiting its popularity.

SeroXen RAT: A Trojan Disguised as a Legitimate Program

The affordability of SeroXen RAT has made it easily accessible to attackers of various skill levels. Since its emergence in September 2022, AT&T has documented hundreds of instances of SeroXen RAT usage, with the activity showing no signs of slowing down. Initially targeting casual gamers, it is crucial to recognize that as the tool gains more traction, its target audience may expand to include larger companies and organizations, raising the stakes for cybersecurity professionals.

The Technical Aspects of SeroXen RAT

To comprehend the capabilities and complexities of SeroXen RAT, it is important to understand its underlying technical components. The Trojan is built upon various open-source projects, namely the Quasar RAT, r77 rootkit, and NirCmd utility. By combining these resources, the developer of SeroXen has crafted a Trojan that proves elusive to both static and dynamic analysis, evading detection by security measures.

1. Quasar RAT: The Foundation of SeroXen

Quasar RAT, first released in 2014, serves as the basis for SeroXen RAT. This remote administration tool boasts features such as reverse proxy, remote shell, remote desktop, TLS support, and file management. With its latest version, 1.41, readily available on platforms like GitHub, Quasar RAT provides a solid foundation for the enhanced capabilities of SeroXen.

2. r77 Rootkit: Enhancing Stealth and Persistence

The r77 rootkit, operating at Ring 3 level, is another key component incorporated into SeroXen RAT. This open-source rootkit facilitates fileless persistence on the target system, enabling functionalities such as child process hijacking, malicious code injection, memory process injection, and antivirus bypass. By leveraging the capabilities of the r77 rootkit, SeroXen achieves a heightened level of stealth and persistence within compromised systems.

3. NirCmd: Windows System Management Utility

NirCmd, a free command-line utility, plays a significant role in the functionality of SeroXen RAT. This utility offers a range of simple tasks for managing Windows systems and peripherals. By integrating NirCmd into SeroXen, the Trojan gains additional capabilities for managing and manipulating the infected system, further augmenting its remote access capabilities.

Attack Vectors and Distribution of SeroXen RAT

AT&T's analysis has shed light on the common attack vectors employed by cybercriminals to distribute SeroXen RAT. Phishing emails and Discord channels have emerged as prominent channels for spreading this malware. Attackers often distribute ZIP archives containing heavily obfuscated batch files through these channels. From these archives, base64 encoded binaries are extracted and loaded into memory using .NET Reflection, evading traditional antivirus detection mechanisms.

The Execution Process and Payload Deployment

Upon successful infiltration, SeroXen RAT proceeds with the execution process and deploys its payload within the compromised system. The malware modifies a file named "msconfig.exe," located in the "C:\Windows\System32" directory, adding an extra space after "Windows." This modification is crucial for the subsequent execution of the malware. The modified file is temporarily stored and swiftly removed after the program installation. Subsequently, a payload named "InstallStager.exe," which is essentially a variant of the r77 rootkit, is deployed onto the target device. This payload remains obfuscated within the Windows Registry and is later activated using PowerShell through the Task Scheduler. The payload injects itself into the "winlogon.exe" process, effectively integrating the SeroXen Trojan into the system's memory, rendering it invisible to conventional detection techniques.

Integration and Functionality of SeroXen Trojan

Once the SeroXen Trojan is fully operational, it establishes a connection with the Command and Control (C2) server, awaiting further instructions from the attackers. AT&T's analysts have discovered that SeroXen shares the same TLS certificate as Quasar RAT, indicating a connection between the two. Moreover, SeroXen retains most of the features present in the original Quasar RAT, including TCP stream support, efficient network serialization, and QuickLZ compression.

Concerns and Future Implications

The rapid growth in popularity of SeroXen RAT has raised concerns among researchers and security professionals. While the current victims primarily consist of casual gamers, the potential shift towards targeting larger organizations poses significant threats. Recognizing this emerging risk, AT&T has released Indicators of Compromise (IoC), enabling security professionals to proactively prepare their enterprises against potential attacks.

Indicators of Compromise (IoC) and Preparedness

To mitigate the risks associated with SeroXen RAT, AT&T has provided security professionals with a list of Indicators of Compromise (IoC). These IoCs serve as valuable resources for detecting and responding to potential SeroXen infections. By promptly identifying and mitigating the presence of SeroXen, organizations can bolster their cybersecurity defenses and minimize the potential impact of attacks.

Conclusion

The rise of SeroXen RAT as a popular remote access Trojan has underscored the evolving landscape of cyber threats. Its affordability and powerful capabilities have made it an attractive tool for cybercriminals, with an increasing potential for targeting larger organizations. Understanding the technical intricacies and distribution methods of SeroXen is crucial for security professionals to detect, prevent, and respond to potential attacks. By staying vigilant and leveraging the provided Indicators of Compromise (IoC), organizations can fortify their defenses and protect themselves against this emerging threat.

FAQs

More Posts