XenoRAT Delivered Through Excel XLL With ConfuserEx Obfuscation
Summary
Researchers analyzed a XenoRAT dropper delivered as an Excel XLL, protected with ConfuserEx and Excel-DNA. The chain used a decoy PDF and led to a XenoRAT payload communicating with a hardcoded C2 server.
Key points
- The sample arrived in a ZIP archive containing a malicious Payment_Details.xll file and a generic financial-transaction message.
- The XLL abused Excel-DNA to load .NET components and launched an obfuscated batch file and password-protected SFX archive.
- A decoy PDF named Pago.pdf opened while the malware chain ran in the background.
- Researchers uncovered a XenoRAT payload and an additional remote-access tool; ConfuserEx and other obfuscation hindered analysis.
- The XenoRAT configuration contained C2 address 87.120.116[.]115, communicating over TCP port 1391.
- The payload had an anomalous 2052 compilation timestamp, which researchers say may help evade timestamp-based detection.
- The article recommends monitoring or blocking uncommon file extensions such as XLL.
Article Details
- Attack Vectors
- XenoRAT was delivered in a malicious Excel XLL file titled Payment Details, with a generic business-style message and a decoy PDF intended to support the appearance of a financial transaction.
- The XLL triggered an obfuscated batch file that initiated an SFX archive and another executable; the XLL acted as a dropper for XenoRAT and an additional remote access tool.
- Defensive Notes
- Monitor or block less commonly used file extensions such as XLL when appropriate.
- Monitor for obfuscated batch files, SFX archives, and executables protected with ConfuserEx.
- Monitor the reported XenoRAT C2 address and TCP port 1391.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 87[.]120[.]116[.]115 | Reported XenoRAT command-and-control IP address; the article says it communicates over TCP port 1391. |
| SHA256 | 18aa15aaf6886e277aea1333b546be83a56bccdfa7a64ce5243ebed2dd2541fb | Hash of Original.exe, identified in the article as the XenoRAT payload. |
| SHA256 | 18abc987c2a04a7c576d7a5c86588467cbf6cc2bb15eadbc60c0336e2fff11d8 | Hash listed for cfgdf.bat, the obfuscated batch file triggered by the malicious XLL. |
| SHA256 | 46affe6213f26e1a5446134c994e14d3f3f500e3c88f7867e3102c4b171cead1 | Hash of cvghfy.exe, an executable in the reported malicious execution chain. |
| SHA256 | 48a60db5241e6ecadbb9705ed014ba58ea9608d5ae0264db04fe70201fd1b152 | Hash of the malicious Payment_Details.xll dropper. |
| SHA256 | 72722737a28ed8371130b181f99a12bd7f43b9cb9043e7a1257c08394e57e17b | Hash listed for cvghfy.sfx.exe, an SFX RAR archive in the reported execution chain. |
| SHA256 | 7a0e40d4c39eae8f7415cb44504e04c1baf41f57e797308f026409c7353ed03d | Hash of the Pago.pdf decoy included in the reported malicious file set. |
| SHA256 | 7fddca3e05425b8ec73f701334a57532f9b6bc626f8402de5135de91b8a0b59e | Hash of the archive reported as containing the malicious XLL and accompanying file. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe article describes an obfuscated MAIN module and an obfuscated batch file used in the delivery chain.T1059.003 · Windows Command ShellThe XLL triggered an obfuscated batch file that initiated subsequent executables.T1204.002 · Malicious FileThe deployment used a malicious Excel XLL file that was executed to start the infection chain.
Malware
Products
Tools
ConfuserExin this case, delivered as an XLL file generated with the open-source Excel-DNA framework, protected by ConfuserEx, and titled "Payment Details."Detect It Easycvghfy.exe," runs, likely extracted from within the archive. Using tools like Detect It Easy reveals signs of obfuscation, packing, and the use of ConfuserEx-indicating the threat actor(s) went to a great deal ofdnSpythe latter identified as the XenoRAT payload. Opening Original.exe in dnSpy exposes XenoRAT's configuration, including the hardcoded command-and-control (C2) server address.Excel-DNAremote access tool was, in this case, delivered as an XLL file generated with the open-source Excel-DNA framework, protected by ConfuserEx, and titled "Payment Details."Unpac.meFigure 5: Analysis results of cvghfy.exeUsing an awesome tool like Unpac.me, we were able to uncover an additional executable, "