Seqrite Details SideCopy-Linked XenoRAT Campaign Targeting Afghanistan’s Finance Ministry
Summary
Seqrite Labs details Operation XENOFISCAL, a SideCopy-linked spear-phishing campaign targeting Afghanistan’s Ministry of Finance. A Pashto-named LNK launches a multi-stage loader that deploys XenoRAT; attribution is assessed with medium-to-high confidence.
Key points
- Seqrite reports targeting of Afghanistan’s Ministry of Finance, provincial Mustoufiats and Pashto-speaking government officials; it assesses SideCopy attribution with medium-to-high confidence.
- A ZIP archive contains a Pashto-named LNK that launches mshta.exe to retrieve a remote HTA from abimj[.]edu[.]af.
- The analyzed chain uses obfuscated JavaScript, .NET deserialization, staged DLLs and in-memory shellcode execution to deliver XenoRAT.
- The malware establishes persistence through a Registry Run key and a scheduled task named XenoUpdateManager.
- The XenoRAT sample uses TCP command-and-control at 185.235.137.106 and a mutex named clouda; the article also describes encrypted communications and SOCKS5 tunneling capabilities.
- Seqrite says the delivery infrastructure shared an Afghan government-related IP block with more than 200 government and education domains, while the C2 host was on HZ Hosting; the researchers cite these overlaps in their attribution assessment.
Article Details
- Attack Vectors
- Spear phishing delivered a ZIP archive containing a malicious LNK file with a Pashto filename crafted to resemble an internal government document.
- The LNK launched mshta.exe to retrieve remote HTA content from the compromised abimj.edu.af domain.
- Obfuscated JavaScript and staged .NET payloads decoded and reconstructed components in memory before shellcode loaded XenoRAT.
- The loader established persistence through a current-user Registry Run entry; XenoRAT also supports persistence through a scheduled task.
- XenoRAT connected to hardcoded C2 infrastructure over TCP using encrypted communications.
- Defensive Notes
- Investigate and monitor the reported delivery domain, payload URLs, and C2 IP 185.235.137.106; the article says the delivery IPs also hosted legitimate Afghan government and education domains.
- Review HKCU\Software\Microsoft\Windows\CurrentVersion\Run for the value name Edgre and check for the scheduled task XenoUpdateManager.
- Look for suspicious mshta.exe activity, obfuscated HTA or JavaScript execution, and staged payloads in C:\Users\Public, including the reported USOShared-1de48789-1285 and firefx-1de87eec8-1241 directories.
- Use the reported SHA-256 hashes to check for the malicious archive, LNK, decoy PDF, loader stages, and XenoRAT payload.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | abimj[.]edu[.]af | Compromised delivery and staging domain used to host campaign content. |
| IPV4 | 103[.]132[.]98[.]224 | IP address to which the malicious delivery domain resolved; the article reports the delivery layer was staged on Afghan government-related infrastructure. |
| IPV4 | 103[.]132[.]98[.]226 | IP address to which the malicious delivery domain resolved; the article reports the delivery layer was staged on Afghan government-related infrastructure. |
| IPV4 | 185[.]235[.]137[.]106 | Hardcoded XenoRAT command-and-control server. |
| SHA256 | 0019212f25eb04bbb33bb194879c095265db7855d6003bdd777cf0cbb90eb772 | SHA-256 of the malicious loader DLL Aotestpass.dll. |
| SHA256 | 194b912c242604d6f9a79369f22338c58a13ce0cc2ed280ce505075808bc2f14 | SHA-256 of the malicious ZIP archive used for spear-phishing delivery. |
| SHA256 | 3b4194bdfe40d94031a94b30397ffd8a4b09d0a4057668e897b8bdcd1703dd01 | SHA-256 of the malicious LNK attachment. |
| SHA256 | 5833917bd137804f5a021d2cb37adfe5c4b7b67dbb06d59c3b9c5cf393835e45 | SHA-256 of the persistence batch file noway.bat. |
| SHA256 | 8f2d979ef33b2900351c94c7335275a9342c75189e1a901998e90a539e944a1a | SHA-256 of the malicious loader DLL WayBroad.dll. |
| SHA256 | 99127c8c67d90e2776beeb85281f9c68399bf4567b07a6b638d68b760212e88d | SHA-256 of the staged HTA payload zuidrt.hta. |
| SHA256 | 9ae3d785486022af82ea92e51b26e3f55c1bba88a7be2ad9790f4240e8499d14 | SHA-256 of the XenoRAT payload. |
| SHA256 | a63e90ee57a1f213a8fe76ef1a6cff5ae9ed7ebceda258431533825e648c0c67 | SHA-256 associated with the delivered HTA stage ugayt.hta. |
| SHA256 | df9173a28c0b0b878c10a53d35cd7ce6f6ed66d207b6b7c4ff723721f1c027ab | SHA-256 of the decoy PDF used during the infection chain. |
| URL | hxxp[:]//abimj[.]edu[.]af/institute/cloudiya/ | Staging URL used by the loader to retrieve the next-stage HTA payload. |
| URL | hxxp[:]//abimj[.]edu[.]af/institute/cloudiyaf/document.pdf | Specific decoy-document URL downloaded by the malicious loader from the compromised delivery domain. |
| URL | hxxps[:]//abimj[.]edu[.]af/institute/10/ | Hardcoded payload-delivery URL used by the loader. |
| URL | hxxps[:]//abimj[.]edu[.]af/institute/7/ | Alternate hardcoded payload-delivery URL selected based on the victim operating system. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe JavaScript, encoded strings, and staged payload data were obfuscated or encoded to hinder analysis.T1053.005 · Scheduled TaskXenoRAT can create the XenoUpdateManager scheduled task for logon persistence.T1059.003 · Windows Command ShellThe loader used cmd.exe to launch files and execute persistence commands.T1059.007 · JavaScriptObfuscated JavaScript in the HTA stages decoded and executed malicious logic.T1070.004 · File DeletionXenoRAT’s uninstall routine can delete its executable after removing persistence.T1095 · Non-Application Layer ProtocolXenoRAT established TCP-based command-and-control communication with its hardcoded server.T1106 · Native APIThe shellcode loader used Windows APIs including VirtualAlloc and CreateThread to execute reconstructed shellcode.T1129 · Shared ModulesXenoRAT dynamically loaded external DLL assemblies received through its remote Node connection.T1140 · Deobfuscate/Decode Files or InformationThe loader decoded Base64 data and decompressed GZIP payloads before execution.T1218.005 · MshtaThe LNK launched mshta.exe to retrieve and execute remote HTA content.T1518.001 · Security Software DiscoveryXenoRAT queried WMI antivirus product information to identify installed security software.T1547.001 · Registry Run Keys / Startup FolderThe loader created the HKCU Run value Edgre to launch the staged HTA at user logon.T1566.001 · Spearphishing AttachmentThe campaign used spear phishing to deliver a ZIP archive containing a malicious LNK attachment.T1573 · Encrypted ChannelThe article reports that XenoRAT encrypts C2 data using AES and a shared key.T1620 · Reflective Code LoadingThe loader reconstructed and loaded the managed XenoRAT payload in memory using reflective loading techniques.
Threat Actors
APT36The article describes SideCopy as operating under the broader APT36 umbrella; the campaign is specifically attributed to SideCopy with medium-to-high confidence.SideCopySeqrite attributes the campaign to the SideCopy cluster with medium-to-high confidence based on overlapping TTPs and infrastructure patterns.Transparent TribeThe article describes SideCopy as operating under the broader Transparent Tribe umbrella; the campaign is specifically attributed to SideCopy with medium-to-high confidence.
Malware
Products
Countries
AfghanistanSeqrite Labs analyzed a SideCopy-linked spear phishing campaign targeting Afghanistan’s Ministry of Finance and provincial Mustoufiats, using a Pashto-named LNK file to deliver a multi-stage loader chain that ends inBulgariaInfrastructure analysis showed the delivery domain was hosted on Afghan government-related IP space, while the RAT C2 was on HZ Hosting in Bulgaria/Frankfurt.Pakistancampaigns across the globe and has a well-established history of tracking the SideCopy APT cluster — a Pakistan-linked threat group operating under the broader Transparent Tribe / APT36 umbrella.
Industries
Educationexecuted, the LNK silently leverages mshta.exe to fetch a remote HTA payload from a compromised Afghan education domain, which decodes obfuscated JavaScript in-memory, establishes Registry-based persistencefinanceSeqrite Labs analyzed a SideCopy-linked spear phishing campaign targeting Afghanistan’s Ministry of Finance and provincial Mustoufiats, using a Pashto-named LNK file to deliver a multi-stage loader chain that ends inGovernmentThe attack targeted Afghanistan’s Ministry of Finance, provincial finance directorates, and Pashto-speaking government officials.