Analysis Details Rebex-Based Telegram RAT Delivered Through Trojanized CHM
Summary
An analysis traces a Vietnam-uploaded trojanized CHM through a multi-stage infection chain to a Rebex-based Telegram RAT, detailing its persistence, command capabilities and limited attribution.
Key points
- A ZIP uploaded to VirusTotal from Vietnam on April 1, 2026, contained a trojanized CHM that used a fake document-corruption prompt to trigger execution when opened.
- The CHM launched a renamed Python runtime, which loaded a C++ DLL that used two XOR decryption layers to extract the next-stage components.
- The chain used MSBuild to load a .NET loader, which decoded and decompressed the final payload in memory.
- Persistence included a per-user Winlogon Shell hijack and a scheduled task named “Doubt,” configured to shut down the system weekly.
- The final payload was a weaponized Rebex.Common.dll RAT that used Telegram for command-and-control and supported command execution, file downloads and token swapping.
- The author assessed the activity as possibly targeted at Vietnam but could not confidently attribute it to a specific actor; the final DLL reportedly had zero VirusTotal detections at the time of writing.
Article Details
- Attack Vectors
- A trojanized CHM displays a fake document-corruption prompt and starts the infection when the user clicks either response.
- The CHM uses hh.exe to extract files, then runs a renamed Python interpreter against an extracted .pyc that loads a C++ DLL.
- The DLL decrypts an embedded blob with two XOR layers and drops an MSBuild XML file, a .NET loader, and other components.
- The chain establishes persistence by hijacking the HKCU Winlogon Shell value and creating a scheduled task named "Doubt".
- The final Rebex-based RAT uses a Telegram bot for command and control, supports optional SOCKS5, and accepts commands for check-ins, token swapping, file downloads, and cmd.exe execution.
- Defensive Notes
- Monitor for the described CHM-to-hh.exe-to-renamed-Python execution chain and the extracted .pyc and DLL files.
- Review HKCU Winlogon Shell and HKCU Environment changes, along with creation of the scheduled task named "Doubt".
- The article reports the mutex ODmVyekhvWKUFqvMEsyzbMpgpDcEdrJmGaLxpAMLvBjWXnOQvlottEzBOFftA in the .NET loader.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 1323278360d41a74ab09d310f08902087ff2798d1eda99be65d07c1b1123a25c | SHA-256 hash of the decrypted Telegram RAT payload. |
| SHA256 | 67b51a73c72f39b9cf41dd35eb22b369713ab2e576641b40b9089ebc9d4a1fb2 | SHA-256 hash of ioy24euj.dll, the .NET loader in the infection chain. |
| SHA256 | 6db64b44305ff125f729713d7ff516e84e4ca38504a2ab0571eb19597f49feee | SHA-256 hash of the ZIP archive reported to contain the trojanized CHM sample. |
| SHA256 | a0d5b30578acd1df9139e7a8a4bfc659dc2cf48f4dc0c5804b70890adeb9fa21 | SHA-256 hash of the trojanized CHM delivery sample. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe DLL uses two XOR layers to decrypt an embedded blob containing later-stage components.T1053.005 · Scheduled TaskThe DLL creates a scheduled task named "Doubt" to shut down the system every Friday at midnight.T1059.001 · PowerShellThe article describes the persistent shell hijack as executing msbuild.exe through PowerShell.T1059.003 · Windows Command ShellThe CHM launches cmd.exe to run hh.exe and start the extracted components.T1059.006 · PythonA renamed Python interpreter executes an extracted .pyc that loads the C++ DLL.T1102.002 · Bidirectional CommunicationThe RAT uses a Telegram bot for C2, including check-ins and receipt of commands.T1105 · Ingress Tool TransferA RAT command downloads a file from Telegram to the victim's %TMP% folder.T1127.001 · MSBuildThe infection runs mechaniSm.xml with msbuild.exe to load ioy24euj.dll.T1140 · Deobfuscate/Decode Files or InformationThe .NET loader base64-decodes, XOR-decrypts, and decompresses the embedded payload before loading it in memory.T1204 · User ExecutionThe infection starts when a user opens the CHM and clicks either response on its fake document-corruption prompt.T1547.001 · Registry Run Keys / Startup FolderThe infection establishes persistence by hijacking the HKCU Winlogon Shell value.
Products
Microsoft Windows[T1059.003 ] Command and Scripting Interpreter: Windows Command Shell – The CHM triggers cmd.exe to run hh.exe and launch extracted components (‘cmd.exe, /c start /min cmd /c “hh -decompile %tmp%rupt … && start /min cmdMSBuild.exerenamed Python runtime and a C++ DLL that decrypts a large embedded blob to deploy multiple components (msbuild XML, .NET loader, final Rebex-based Telegram RAT) and establishes persistence via a Winlogon shell hijackPowerShell[Registry Key ] Persistence artifacts – HKCUSoftwareMicrosoftWindows NTCurrentVersionWinlogon /v Shell (shell hijack); HKCUEnvironment entries (Msbd, Pyps, Temprd) used to execute msbuild/powershell)PythonA trojanized CHM sample uploaded to VirusTotal from Vietnam drops a renamed Python runtime and a C++ DLL that decrypts a large embedded blob to deploy multiple components (msbuild XML, .NET loader, final Rebex-based