Researchers Analyze SparkRAT C2 Infrastructure and Malware Delivery

Summary

Hunt researchers analyze SparkRAT’s authentication, C2 behavior, and suspected infrastructure, and use sandbox findings to examine an SFX archive that deploys the RAT.

Key points

SparkRAT is a Go-based, multi-platform remote access tool that communicates over WebSockets and HTTP(S); its server uses port 8000 by default.
The article describes basic HTTP authentication and a 401 response that, combined with port 8000, can help narrow searches for suspected SparkRAT servers.
Researchers examined 95.164.0[.]23, which VirusTotal associated with four communicating files and a self-signed TLS certificate; the IP no longer responded to requests.
Sandbox analysis found an SFX archive containing a batch file and a password-protected SFX file that ultimately deploys and launches the SparkRAT client.
The researchers used sandbox results and crowdsourced Sigma and IDS rules to support their assessment of the IP as a SparkRAT C2 server.

Article Details

Attack Vectors: A self-extracting archive bundles a batch file and a password-protected SFX archive that deploys and launches the SparkRAT client.
SparkRAT communicates with its C2 over WebSockets and HTTP(S). Its server uses port 8000 by default, which the article says may help identify servers when combined with other factors.
SparkRAT's administrative functions use username and password authentication over HTTP.
Defensive Notes: Correlate HTTP response headers with use of the default port 8000 to narrow potential SparkRAT server detections; the article cautions that the response headers alone would produce many results.
Use sandbox resources such as Hatching Triage and VirusTotal to examine files communicating with suspicious IPs and corroborate suspected SparkRAT C2 infrastructure.
The article advises care when conducting internet-wide scanning and notes that port 8000 is not a definitive indicator on its own.

Indicators of compromise

Type	Indicator	Context
IPV4	`95[.]164[.]0[.]23`	Suspected SparkRAT C2 IP; the article says VirusTotal found files communicating with it and concludes it is a SparkRAT C2 server.
MD5	`0095c9d4bc45fed4080e72bd46876efd`	Hash listed for iox.exe in the SparkRAT file indicators.
MD5	`3261cbac9f0ad69dd805bfd875eb0161`	MD5 hash of the SFX archive described as deploying and launching the SparkRAT client.
MD5	`8f2df5c6cec499f65168fae5318dc572`	Hash listed for hesf.exe in the SparkRAT file indicators.
SHA1	`316fa09f467ba90ac34a054daf2e92e6e2854ff8`	SHA1 hash listed for 1.bat, included in the archive that deploys and launches SparkRAT.
SHA1	`3471247cffded4259b12593cce644c7c9470a4d2`	SHA1 hash listed for 3261cbac9f0ad69dd805bfd875eb0161.exe, a SparkRAT-related file.
SHA1	`4d30a84eda510596e528a7adbac23148618d5a62`	SHA1 hash listed for work.exe, included in the SparkRAT file indicators.