๐ฝ๐ด๐๐๐ด๐๐ด๐ฒ
ANY.RUN๐จ ๐ฆ๐ฝ๐ฎ๐ป๐ธ: ๐๐ฒ๐ด๐ถ๐๐ถ๐บ๐ฎ๐๐ฒ ๐ฃ๐ฟ๐ผ๐ฐ๐ฒ๐๐ ๐๐ฏ๐๐๐ฒ, ๐๐ฒ๐น๐ฎ๐๐ฒ๐ฑ ๐๐ฒ๐๐ฒ๐ฐ๐๐ถ๐ผ๐ป, ๐ฎ๐ป๐ฑ ๐ฅ๐๐ง ๐ฃ๐ฒ๐ฟ๐๐ถ๐๐๐ฒ๐ป๐ฐ๐ฒ.
We caught a two-component Rust-based RAT toolkit we're calling #SpankRAT. Because C2 traffic originates from legitimate system processes, ๐๐ต๐ถ๐ ๐ฎ๐ฐ๐๐ถ๐๐ถ๐๐ ๐ฐ๐ฎ๐ป ๐ฏ๐๐ฝ๐ฎ๐๐ ๐ฟ๐ฒ๐ฝ๐๐๐ฎ๐๐ถ๐ผ๐ป-๐ฏ๐ฎ๐๐ฒ๐ฑ ๐ฐ๐ผ๐ป๐๐ฟ๐ผ๐น๐ ๐ฎ๐ป๐ฑ ๐ฏ๐ฒ ๐ฑ๐ฒ๐ฝ๐ฟ๐ถ๐ผ๐ฟ๐ถ๐๐ถ๐๐ฒ๐ฑ ๐ฑ๐๐ฟ๐ถ๐ป๐ด ๐๐ฟ๐ถ๐ฎ๐ด๐ฒ, reducing SOC visibility and increasing the risk of missed compromise. As a result, attackers gain stealthy persistence and hands-on control within the environment โ ๏ธ
โ๏ธ At the time of analysis, most samples remain undetected on VirusTotal.
โก๏ธ Behavioral analysis is essential for detecting threats like this. #ANYRUN Sandbox reveals the full execution chain, injection activity, C2 communication, and privilege escalation in real time, helping teams confirm malicious activity faster when traditional detection fails.
1๏ธโฃ The attack starts with ๐ฆ๐ฝ๐ฎ๐ป๐ธ๐๐ผ๐ฎ๐ฑ๐ฒ๐ฟ, a lightweight loader that retrieves the main payload from C2 over plain HTTP, escalates privileges, and injects it into ๐ฒ๐ ๐ฝ๐น๐ผ๐ฟ๐ฒ๐ฟ.๐ฒ๐ ๐ฒ using classic DLL injection, establishing persistence via a Scheduled Task.
2๏ธโฃ Once loaded inside explorer.exe, ๐ฆ๐ฝ๐ฎ๐ป๐ธ๐ฅ๐๐ง communicates with C2 over WebSocket and provides full remote access to the system. The full-featured variant supports ๐ญ๐ด ๐๐ฒ๐ฟ๐๐ฒ๐ฟ ๐ฐ๐ผ๐บ๐บ๐ฎ๐ป๐ฑ๐ covering remote shell execution, file management (list/read/upload/delete/rename), process enumeration and killing, Windows service control (start/stop/restart), full registry CRUD, scheduled task manipulation, and software inventory.
๐ Execution chain:
SpankLoader โก๏ธ Download from C2 โก๏ธ Drop DLL to C:\ProgramData\ โก๏ธ SeDebugPrivilege โก๏ธ DLL injection into explorer.exe โก๏ธ Scheduled Task (persistence) โก๏ธ SpankRAT โก๏ธ WebSocket C2 โก๏ธ RAT ๐จ
๐๐ถ๐ป๐ฑ ๐๐ต๐ฒ ๐ณ๐๐น๐น ๐๐ฎ ๐ฐ๐ผ๐บ๐บ๐ฎ๐ป๐ฑ ๐๐ฒ๐ ๐ฎ๐ป๐ฑ ๐๐ข๐๐ ๐ถ๐ป ๐๐ต๐ฒ ๐ฐ๐ผ๐บ๐บ๐ฒ๐ป๐๐ ๐
๐จโ๐ป See the analysis session: https://app.any.run/tasks/56306614-e569-4ace-a9ce-b27c3b983618/?utm_source=mastodon&utm_medium=post&utm_campaign=spankrat_analysis&utm_content=linktoservice&utm_term=160426
๐ Use this TI Lookup query to pivot from IOCs, review related activity, and validate your detection coverage: https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=spankrat_analysis&utm_content=linktotilookup&utm_term=160426#%7B%22query%22:%22url:%5C%22*/download/rmm_agent.dll*%5C%22%22,%22dateRange%22:60%7D
๐ Strengthen your SOC, detect complex threats faster, and boost team performance with #ANYRUN: https://any.run/enterprise/?utm_source=mastodon&utm_medium=post&utm_campaign=spankrat_analysis&utm_content=linktoenterprise&utm_term=160426
