XenoRAT

This level of detail indicates that the threat actors conducted thorough prior reconnaissance.

The malicious files were delivered through infrastructure hosted on Afghan government servers, allowing the attackers to blend their traffic with legitimate state communications and evade network-level detection.

The attackers used phishing emails containing ZIP archives with a malicious file masquerading as an internal government document.

The complex intrusion sequence initiates through a tailored spear-phishing email delivery path. This electronic mail contains a compressed archive enclosing a fraudulent shortcut file.

It connects to a hard-coded IP address using encrypted TCP traffic and registers itself through both a Windows Scheduled Task named “XenoUpdateManager” and a Registry Run key.

That loader DLL downloaded an encoded, GZIP-compressed blob from attacker-controlled URLs and unpacked it entirely in memory.

Subsequently, the remote web application processes a heavily obfuscated JavaScript payload within the host memory space.

The function manages the dynamic loading and execution of external DLL modules received through a remote Node connection... loads it dynamically using Assembly.Load.

Consequently, unsuspecting provincial finance officials clicked the attachment.

It connects to a hard-coded IP address using encrypted TCP traffic and registers itself through both a Windows Scheduled Task named “XenoUpdateManager” and a Registry Run key.

To ensure a long-term presence, the software establishes automated registry execution keys that masquerade as legitimate Windows applications.

It connects to a hard-coded IP address using encrypted TCP traffic and registers itself through both a Windows Scheduled Task named “XenoUpdateManager” and a Registry Run key.

the malware directly allocates executable memory within the current process using the Windows API VirtualAlloc()... copies the reconstructed shellcode buffer into the allocated region... and transfers execution to the injected buffer through the CreateThread() API.

To ensure a long-term presence, the software establishes automated registry execution keys that masquerade as legitimate Windows applications.

The loader script implements a custom Base64 decoding routine to hide its downstream modules.

This staged approach is commonly used in fileless malware... reconstruct the serialized payload entirely in memory without touching disk.

To ensure a long-term presence, the software establishes automated registry execution keys that masquerade as legitimate Windows applications.

the malware directly allocates executable memory within the current process using the Windows API VirtualAlloc()... copies the reconstructed shellcode buffer into the allocated region... and transfers execution to the injected buffer through the CreateThread() API.

It launches a hidden cmd.exe process with a Base64-decoded command (/C choice /C Y /N /D Y /T 3 & Del) that waits for a few seconds and then deletes the running executable file from disk.

The malware later decompresses and decodes the data to reconstruct the final HTA payload... The routine first decodes the Base64 blob... and utilizes the .NET GZipStream class to restore the original payload buffer.

Instead of dropping a binary immediately, the shortcut covertly launches the native Windows command tool mshta.exe. This legitimate system binary fetches an externally hosted hypertext application file from a compromised domain.

The malware runs a mutex called “clouda” to prevent duplicate instances.

The malware runs a mutex called “clouda” to prevent duplicate instances, and it queries installed antivirus products before reporting back to its operators.

The malware creates a directory named USOShared-1de48789-1285 under C:\Users\Public\ to store the next-stage HTA payload... The directory naming convention mimics application-generated cache or profile folders.

Specifically, the malware handles this payload reconstruction phase strictly within volatile memory.

Performs keylogging, screen capture, clipboard monitoring, and webcam/microphone surveillance.

The script then checks whether the .NET Framework version v4.0.30319 is installed by querying the registry path HKLM\SOFTWARE\Microsoft\.NETFramework\v4.0.30319.

dynamically selects the download endpoint based on the victim operating system version. Systems identified as Windows 7 (Version 6.1) are redirected to an alternate payload location.

The malware runs a mutex called “clouda” to prevent duplicate instances, and it queries installed antivirus products before reporting back to its operators.

Performs keylogging, screen capture, clipboard monitoring, and webcam/microphone surveillance.

Performs keylogging, screen capture, clipboard monitoring, and webcam/microphone surveillance.

Performs keylogging, screen capture, clipboard monitoring, and webcam/microphone surveillance.

Subsequently, once fully initialized, the backdoor implants open a persistent command channel back to the malicious operators. This outgoing data stream targets a dedicated server node located at internet protocol destination 185.235.137.106.

After the shortcut file launched mshta.exe, it pulled an HTML Application payload from abimj.edu.af... The final stage deployed XenoRAT 1.8.7... which established an encrypted connection to a bulletproof server in Frankfurt, Germany.

Supports SOCKS5 proxy-based network tunneling.

ConnectAndSetupAsync function is responsible for establishing and initializing a TCP-based command-and-control (C2) connection between the client and the remote server.

After the shortcut file launched mshta.exe, it pulled an HTML Application payload from abimj.edu.af... That loader DLL downloaded an encoded, GZIP-compressed blob from attacker-controlled URLs and unpacked it entirely in memory.

Once opened, the file silently installed XenoRAT, an open-source remote access trojan that allows attackers to maintain long-term access to infected systems.

The final stage deployed XenoRAT 1.8.7... which established an encrypted connection to a bulletproof server in Frankfurt, Germany... It connects to a hard-coded IP address using encrypted TCP traffic.

In Donut loaders, the shellcode bypass security mechanisms by patching functions such as AmsiScanBuffer() to disable AMSI scanning.