FLEXRAT Stealer and RAT Uses Fake ChilloutVR Mods to Steal Credentials
Summary
Researchers detail FLEXRAT, a stealer and remote-access tool delivered through fake ChilloutVR mod sites and Dropbox downloads. It steals browser credentials and Discord data, captures screens, enables remote control, and establishes persistence.
Key points
- Fake ChilloutVR mod and plugin sites promoted through search results deliver FLEXRAT installers hosted on Dropbox.
- The multi-component toolset includes an encrypted Electron payload and steals browser passwords, cookies, sessions, Discord tokens, and backup codes.
- FLEXRAT gathers system and security-product information, captures screenshots, streams screens, and supports remote keyboard, mouse, file, and command control.
- With administrative access, it weakens UAC and persists through Run keys and a scheduled task, masquerading as Windows Service Host.
- The malware sends stolen data to its command-and-control infrastructure and also uses Discord for reporting.
- Researchers recommend treating infections as credential-exposure events and hunting for browser termination, suspicious child processes, UAC changes, persistence, and unusual outbound reporting.
Article Details
- Attack Vectors
- Search-result positioning for “ChilloutVR Mods” and “ChilloutVR Plugins” directs users to counterfeit game-modification websites.
- Game-themed lure pages distribute malicious executables and archives through specific Dropbox share links, commonly using dl=1 for direct downloads.
- Users execute counterfeit mod or plugin installers containing NSIS-packaged Electron applications and encrypted JavaScript modules.
- After obtaining user-approved elevation, the implant weakens UAC settings and establishes registry Run-key and scheduled-task persistence.
- Defensive Notes
- Treat FLEXRAT infection as a credential-exposure event because the malware collects browser passwords, session cookies, Discord tokens, and backup codes.
- Monitor Electron applications running from user-writable paths that spawn Node, PowerShell, Python, VBScript, fltmc, reg query, or taskkill.
- Detect rapid termination of multiple browsers and headless or remote-debugging browser launches from non-browser parents.
- Monitor security-product enumeration, MachineGuid registry reads, and token access to privileged processes such as lsass.exe and winlogon.exe.
- Alert when non-management processes set ConsentPromptBehaviorAdmin or PromptOnSecureDesktop to 0.
- Hunt for Windows Service Host Run values, the WindowsServiceHost scheduled task, and executables under %ProgramData%\Microsoft\WindowsServiceHost.
- Detect attrib +h +s operations on files and directories under ProgramData, AppData, or Temp.
- Flag or block executable and archive downloads from consumer file-sharing services, including Dropbox direct-download links.
- Use WDAC or AppLocker to restrict unsigned executables in user-writable locations.
- Enforce UAC settings through Group Policy and keep daily-use accounts outside the local Administrators group.
- Block or sinkhole the reported C2 and lure infrastructure, and alert on Discord webhook or CDN reporting from non-browser processes.
- The recovered AntiSandbox checks appear unreferenced in the analyzed sample; their presence does not establish that they executed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | chilloutmod[.]com | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutmod[.]pages[.]dev | Cloudflare Pages-hosted FLEXRAT lure impersonating ChilloutVR modifications. |
| DOMAIN | chilloutmode[.]com | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutmodes[.]com | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutmods[.]netlify[.]app | Netlify-hosted ChilloutVR-themed FLEXRAT lure. |
| DOMAIN | chilloutmods[.]pages[.]dev | Cloudflare Pages-hosted ChilloutVR-themed FLEXRAT lure. |
| DOMAIN | chilloutmodsvr[.]netlify[.]app | Netlify-hosted ChilloutVR-themed FLEXRAT lure. |
| DOMAIN | chilloutmodsvr[.]pages[.]dev | Cloudflare Pages-hosted ChilloutVR-themed FLEXRAT lure. |
| DOMAIN | chilloutmodvr[.]com | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutmodvr[.]info | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutmodvr[.]netlify[.]app | Netlify-hosted ChilloutVR-themed FLEXRAT lure. |
| DOMAIN | chilloutmodvr[.]online | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutmodvrr[.]netlify[.]app | Netlify-hosted ChilloutVR-themed FLEXRAT lure. |
| DOMAIN | chilloutplugin[.]com | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutplugins[.]info | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutplugins[.]netlify[.]app | Netlify-hosted ChilloutVR-themed FLEXRAT lure. |
| DOMAIN | chilloutsmods[.]com | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutsvrmod[.]com | FLEXRAT lure infrastructure with a FlexRat Secure Platform title and ChilloutVR-themed apex content. |
| DOMAIN | chilloutsvrmod[.]com[.]tr | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutsvrmod[.]info | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutsvrmod[.]online | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutsvrmods[.]com | FLEXRAT lure linking to the Dropbox-hosted Vrmod_Setup.exe payload. |
| DOMAIN | chilloutsvrmods[.]com[.]tr | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutsvrmods[.]info | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutsvrmods[.]online | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutsvrworld[.]com | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutvr-docs[.]pages[.]dev | Cloudflare Pages-hosted ChilloutVR-themed FLEXRAT lure. |
| DOMAIN | chilloutvr-mods[.]netlify[.]app | Netlify-hosted ChilloutVR-themed FLEXRAT lure. |
| DOMAIN | chilloutvr-x[.]netlify[.]app | Netlify-hosted ChilloutVR-themed FLEXRAT lure. |
| DOMAIN | chilloutvr[.]cc | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutvr[.]info | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutvr[.]online | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutvr[.]org | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutvr[.]vip | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutvrbeta[.]netlify[.]app | Netlify-hosted ChilloutVR-themed FLEXRAT lure. |
| DOMAIN | chilloutvrchat[.]com | VRChat-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutvrgame[.]net | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutvrhub[.]com | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutvrlabs[.]com | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutvrlabs[.]com[.]tr | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutvrlabs[.]info | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutvrlabs[.]online | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutvrmod[.]com | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutvrmod[.]net | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutvrmod[.]org | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutvrmod[.]vip | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutvrmodded[.]com | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutvrmodded[.]net | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutvrmods[.]com | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutvrmods[.]net | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutvrmods[.]netlify[.]app | Netlify-hosted ChilloutVR-themed FLEXRAT lure. |
| DOMAIN | chilloutvrmods[.]netliy[.]app | Hostname explicitly listed as ChilloutVR-themed FLEXRAT lure infrastructure. |
| DOMAIN | chilloutvrmods[.]pages[.]dev | Cloudflare Pages-hosted ChilloutVR-themed FLEXRAT lure. |
| DOMAIN | chilloutvrmods[.]xyz | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutvrplugin-d6v[.]pages[.]dev | Cloudflare Pages-hosted ChilloutVR-themed FLEXRAT lure. |
| DOMAIN | chilloutvrplugin[.]com | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutvrplugin[.]xyz | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutvrplugins[.]com | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutvrsmod[.]com | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutvrsmod[.]net | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chilloutworlds[.]com | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chillvrmod[.]com | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | chillvrmod[.]online | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | customvrchat[.]com | VRChat-themed FLEXRAT lure hostname. |
| DOMAIN | flexrat[.]com | FLEXRAT managed-component engine-delivery host; also reported among C2 and panel hosts. |
| DOMAIN | flexrat[.]org | FLEXRAT Electron reporting and remote-control host. |
| DOMAIN | l874[.]lol | FLEXRAT-related infrastructure contacted by a Go artifact. |
| DOMAIN | l874[.]xyz | Panel host recovered from decrypted FLEXRAT configuration. |
| DOMAIN | lexoramods[.]com | Related lure hostname listed in the FLEXRAT investigation. |
| DOMAIN | modschillout[.]com | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | modschilloutvr[.]com | ChilloutVR-themed FLEXRAT lure hostname. |
| DOMAIN | modschilloutvr[.]netlify[.]app | Netlify-hosted ChilloutVR-themed FLEXRAT lure. |
| DOMAIN | qabyostore[.]icu | Related lure hostname listed in the FLEXRAT investigation. |
| DOMAIN | vrchatmod[.]com | VRChat-themed FLEXRAT lure hostname. |
| DOMAIN | vrchatmodes[.]com | VRChat-themed FLEXRAT lure hostname. |
| DOMAIN | vrchatsmod[.]netlify[.]app | Netlify-hosted VRChat-themed FLEXRAT lure. |
| DOMAIN | vrchilloutmod[.]com | Hostname listed as VRChat-themed FLEXRAT lure infrastructure. |
| DOMAIN | vrchilloutmods[.]com | Hostname listed as VRChat-themed FLEXRAT lure infrastructure. |
| DOMAIN | vrchilloutmods[.]shop | Hostname listed as VRChat-themed FLEXRAT lure infrastructure. |
| DOMAIN | vrcplugin[.]com | VRChat-themed FLEXRAT lure hostname. |
| DOMAIN | vrcpluginlab[.]com | VRChat-themed FLEXRAT lure hostname. |
| URL | hxxp[:]//www[.]dropbox[.]com/scl/fi/58zjwuoe83qjjpj7tt3y2/ChilloutVrMod[.]exe?rlkey=vojb0l0ls4uc32z51ykogot24&st=wftymyy8&dl=1/ | Specific Dropbox-hosted FLEXRAT payload link for ChilloutVrMod.exe, plain-HTTP variant. |
| URL | hxxp[:]//www[.]dropbox[.]com/scl/fi/7hp56yj650o4slrllg4xj/ChilloutVRMod[.]exe?rlkey=s69vdpczdpalbo26alwo0u13o&st=f5mgwsxk&dl=1/ | Specific Dropbox-hosted FLEXRAT payload link for ChilloutVRMod.exe, plain-HTTP variant. |
| URL | hxxp[:]//www[.]dropbox[.]com/scl/fi/ltfvmwrjb1muy5evusjqp/Chillout-VR-Mods[.]zip?rlkey=cyjdi4lu89o3asio0u2why0fj&st=evbv1apd&dl=1/ | Specific Dropbox-hosted FLEXRAT payload archive link, plain-HTTP variant. |
| URL | hxxp[:]//www[.]dropbox[.]com/scl/fi/otfakqkze127a701il1zh/vrmod_setup[.]exe?rlkey=deryztzard7w3n2btuqo7ivvd&st=48dlc6qm&dl=1 | Specific Dropbox-hosted FLEXRAT payload link for vrmod_setup.exe, plain-HTTP variant. |
| URL | hxxp[:]//www[.]dropbox[.]com/scl/fi/otfakqkze127a701il1zh/Vrmod_Setup[.]exe?rlkey=deryztzard7w3n2btuqo7ivvd&st=48dlc6qm&dl=1/ | Specific Dropbox-hosted FLEXRAT payload link for Vrmod_Setup.exe, plain-HTTP variant. |
| URL | hxxps[:]//cdn[.]discordapp[.]com/attachments/1498687499898196039/1518406217729445948/image[.]png | Specific Discord-hosted asset identified as the hardcoded thumbnail in FLEXRAT reporting cards. |
| URL | hxxps[:]//flexrat[.]org/cdn/telemetry/error | FLEXRAT wrapper telemetry endpoint receiving host information and missing-module reports. |
| URL | hxxps[:]//l874[.]xyz | Operator panel URL linked from FLEXRAT collection reports. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/0rsrugbxi70u1ntgisp1a/ChilloutVRMods-Setup-2[.]1[.]1[.]exe?rlkey=16j52y2an1hi8eb5wdi86wtz3&st=p548et18&dl=1 | Specific Dropbox-hosted FLEXRAT installer download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/19n7l1ifh5ha1x8uvlexy/ChilloutVrMod[.]exe?rlkey=s3452vgfp5c4y3nyh86jw58ta&st=psibftcq&dl=1 | Specific Dropbox-hosted FLEXRAT payload download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/22cucp9cvcjrru5qwe5u5/ChilloutVrMod[.]exe?rlkey=79jxu4d516slqydk1prnaty1g&st=hj68h82r&e=1&dl=1 | Specific Dropbox-hosted FLEXRAT payload download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/34l5x9j2znapj1h70c97m/vrmod_Setup[.]rar?rlkey=ckpqaffuowlxfb8p1h1tq9qqr&st=2vsrjdxt&dl=1 | Specific Dropbox-hosted FLEXRAT payload archive download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/3ah7he0pwamjoiizt1pwi/VrModSetup[.]rar?rlkey=9oiv5cl1hqolbu21i7ofgmvis&st=jiluycdz&dl=1 | Specific Dropbox-hosted FLEXRAT payload archive download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/3vhl2f0sypdk2vmobxfw0/ChilloutVrMod[.]exe?rlkey=h47ewl6fmdcu8t32s0hfpsgag | Specific Dropbox share link staging a FLEXRAT payload. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/3vhl2f0sypdk2vmobxfw0/ChilloutVrMod[.]exe?rlkey=h47ewl6fmdcu8t32s0hfpsgag&st=ism1w2l7&dl=1 | Specific Dropbox-hosted FLEXRAT payload download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/4rzlfjr4cs5e0n5wywkpo/VrChatPlugins[.]exe?rlkey=bedi2i8r7i7d1m1sgfxx7xen1&st=h7irzr5p&dl=1 | Specific Dropbox-hosted FLEXRAT payload disguised as VRChat plugins. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/543sq91b5qgpknm3g9slg/ChillOut_ERP_MODS[.]zip?rlkey=cxb2jdeegeqkm49tuzhzhjr02&st=qo4ht01o&dl=1 | Specific Dropbox-hosted FLEXRAT payload archive download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/58zjwuoe83qjjpj7tt3y2/ChilloutVrMod[.]exe?rlkey=vojb0l0ls4uc32z51ykogot24 | Specific Dropbox share link staging a FLEXRAT payload. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/58zjwuoe83qjjpj7tt3y2/ChilloutVrMod[.]exe?rlkey=vojb0l0ls4uc32z51ykogot24&st=wftymyy8&dl=1 | Specific Dropbox-hosted FLEXRAT payload download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/5toc5n7dn6iuvuz2mnchv/ChilloutVR-Installer[.]exe?rlkey=ug71wqmu1zqo4hq01zj9b9fv3&st=wa0eztb1&dl=1 | Specific Dropbox-hosted FLEXRAT installer download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/5ymo1rxegi5o6tu05wxrb/ChilloutVrMod[.]exe?rlkey=euxl088xf9f95bbx96n55kawn&st=49bj3gx6&dl=1 | Specific Dropbox-hosted FLEXRAT payload download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/7hp56yj650o4slrllg4xj/ChilloutVRMod[.]exe?rlkey=s69vdpczdpalbo26alwo0u13o | Specific Dropbox share link staging a FLEXRAT payload. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/7hp56yj650o4slrllg4xj/ChilloutVRMod[.]exe?rlkey=s69vdpczdpalbo26alwo0u13o&st=f5mgwsxk&dl=1 | Specific Dropbox-hosted FLEXRAT payload download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/7urmetleawb4xtkp7rge8/Chilloutvrmod_64x[.]exe?rlkey=4etnrbmze203qbzeh3vcyh8ze&st=zuxgaweu&dl=0 | Specific Dropbox preview link staging a FLEXRAT payload. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/8ragf48gfd17vm23ml5rs/ChilloutsMod_setup64x[.]exe?rlkey=cklolpt816bgsbypybpnigaw7&st=mewr39bk&dl=1 | Specific Dropbox-hosted FLEXRAT payload download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/8x27d1a8hdsltqiajbi5e/vrmod[.]rar?rlkey=ah50utzt2h6h3dizzsy4ekhu2&st=u8mh2nk7&dl=1 | Specific Dropbox-hosted FLEXRAT payload archive download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/9akfq9btu14j44xvaxvhg/ModLoader[.]exe?rlkey=yooih1ki5b7tkp5ntn510x9l0&st=vivum88k&dl=1 | Specific Dropbox-hosted FLEXRAT payload disguised as a mod loader. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/9vkf3xq0pru0zrsmar2ul/ChilloutvrMods[.]exe?rlkey=pe6tb6dzne2lsubn1eqaynplh&st=qdmp1iwl&dl=1 | Specific Dropbox-hosted FLEXRAT payload download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/abwqmzzpzaojx8cj7fxb5/ChilloutVRChatModSetup[.]exe?rlkey=m1h0d1opjgc07ik3m6ybr85vs&st=t96q5dzu&dl=0 | Specific Dropbox preview link staging a FLEXRAT installer. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/abwqmzzpzaojx8cj7fxb5/ChilloutVRChatModSetup[.]exe?rlkey=m1h0d1opjgc07ik3m6ybr85vs&st=t96q5dzu&dl=1 | Specific Dropbox-hosted FLEXRAT installer download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/bgi9suvtpdj23y8l51sja/ChilloutVrMod[.]exe?rlkey=qtsfve7cajo5vzaml8ncupsxc | Specific Dropbox share link staging a FLEXRAT payload. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/c1q48qu0esrkjjwf1kcrg/ChilloutVR[.]zip?rlkey=cwe2zoas823xn6grh0k9ylhpc&st=hth79qst&dl=1 | Specific Dropbox-hosted FLEXRAT payload archive download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/ca2ddo6roivd7060srbhe/ChilloutsvrMod[.]exe?rlkey=g799cifuovjggjd70cn9o70zd | Specific Dropbox share link staging a FLEXRAT payload. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/cpi960q07wn3trngfe53w/ChilloutVrMod[.]exe?rlkey=xqkojk8nzlnw848akh5s976vd | Specific Dropbox share link staging a FLEXRAT payload. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/dcdivjf5ghqnskqv7hngd/ChilloutVRMods[.]zip?rlkey=l4i3culfodilw946ulcgj0ptd&st=zr8dzwkr&dl=1 | Specific Dropbox-hosted FLEXRAT payload archive download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/dtdxb7ilb2gze0dn5ynhe/ChilloutVR-X62[.]exe?rlkey=daiey8lzb1guttjfwp5i3k292&st=g83wkhb2&dl=1 | Specific Dropbox-hosted FLEXRAT payload download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/dtxmx0ihc24pvye2455qs/Chillout-Mod[.]exe?rlkey=la93pvxgebla6k7fakqhawpdm&st=6qpk64m9&dl=1 | Specific Dropbox-hosted FLEXRAT payload download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/ehjtlctugd0vi8oj0to13/ChilloutVR-Mod[.]exe?rlkey=vg744rmwuuu7zstv7mifwo1y8 | Specific Dropbox share link staging a FLEXRAT payload. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/ehjtlctugd0vi8oj0to13/ChilloutVR-Mod[.]exe?rlkey=vg744rmwuuu7zstv7mifwo1y8&st=euc4cai5&dl=1 | Specific Dropbox-hosted FLEXRAT payload download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/fo6xuu068sa1j8wskbplc/ChilloutVRMods[.]zip?rlkey=nvff1mifs3egerkcmxs8z9pc4 | Specific Dropbox share link staging a FLEXRAT payload archive. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/h6nks7mkbfhshdk7w35kz/ChilloutVRMods-Setup-2[.]1[.]1[.]exe?rlkey=610ltlk8flhox71mptamus2pf&st=6vg26kni&dl=1 | Specific Dropbox-hosted FLEXRAT installer download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/hv9kv2cvu7wibxe9z1hcq/ChillOutVrMods[.]exe?rlkey=533x4mpvz2ha4be7z0l67i4wy&st=28ti4xn3&dl=1 | Specific Dropbox-hosted FLEXRAT payload download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/iayd1g3ltcodhd3vltmsy/ChilloutVRModes[.]rar?rlkey=5m5vnhnuqoyllbvbsoj0l33hr&st=8rhxh636&dl=1 | Specific Dropbox-hosted FLEXRAT payload archive download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/iu1ejfkp6u8bjuvcfidhu/CustomVR-Setup-3[.]78[.]4[.]exe?rlkey=qlqa1zv6dopc37bdo97cshjlt&st=hoh2sgkn&dl=1 | Specific Dropbox-hosted FLEXRAT installer download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/izlwnwd4ub5upnc5e790c/ChilloutVRMods-x64[.]exe?rlkey=y0jz1zgqh4tc7lpjzzjmzz8an&st=6lpl54tu&dl=1 | Specific Dropbox-hosted FLEXRAT payload download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/kkdrv5ln4yizke94qbsd4/VrChatModes[.]rar?rlkey=lw23cwt3828plnfkmn9zzej36&st=i32sk2m7&dl=1 | Specific Dropbox-hosted FLEXRAT payload archive download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/l4hpmsy11ygjhx6mo8624/ChilloutVRSetup[.]zip?rlkey=gthc8o6plgt8eef7319n7gzn2&st=3r1tm9b6&dl=1 | Specific Dropbox-hosted FLEXRAT payload archive download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/lp7q1mv51pl6vdsrox7lt/chilloutvr_mods_setup64x[.]exe?rlkey=qgmfarkuzyhyqhjutfl7twz37&st=pb5wnset&dl=1 | Specific Dropbox-hosted FLEXRAT payload download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/lq55bq5k4fhpzbt25l74d/chilloutvrmod[.]rar?rlkey=iifhths8wl25fqjem1stlodbo&st=ur88pvoy&dl=1 | Specific Dropbox-hosted FLEXRAT payload archive download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/ltfvmwrjb1muy5evusjqp/Chillout-VR-Mods[.]zip?rlkey=cyjdi4lu89o3asio0u2why0fj | Specific Dropbox share link staging a FLEXRAT payload archive. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/ltfvmwrjb1muy5evusjqp/Chillout-VR-Mods[.]zip?rlkey=cyjdi4lu89o3asio0u2why0fj&st=evbv1apd&dl=1 | Specific Dropbox-hosted FLEXRAT payload archive download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/mdnrgswbk6pc6vihqtvi9/ChilloutVRMods[.]zip?rlkey=njuhe53zdgyp3tzpjv5urfoit&st=zkm8uznd&dl=1 | Specific Dropbox-hosted FLEXRAT payload archive download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/ml391r3zzafglnslug3tl/Vrmod_Setup[.]rar?rlkey=km7efhe8g7hqfjwjgvodtpw25&st=k42n9qy7&dl=1 | Specific Dropbox-hosted FLEXRAT payload archive download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/mqy9e43vm3xve3oeiw4nu/VrChatMods-Setup-1[.]0[.]0[.]exe?rlkey=2720fycjl5t2enl0fgamoksxd&st=lc8crejc&dl=1 | Specific Dropbox-hosted FLEXRAT installer download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/my83eu1qh0raay1f4ir7w/ChilloutVR-ChatMod[.]7z?rlkey=s5lc7xukrzkils2qubx6ymluy&st=edvlph6h&dl=1 | Specific Dropbox-hosted FLEXRAT payload archive download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/nolk72zd5c719i0dag7gn/ChilloutVRMod[.]exe?rlkey=ftkccofc8mkgfhx270dp2hi5n | Specific Dropbox share link staging a FLEXRAT payload. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/ns0cy91r5q4eekwut9tbv/ChilloutMods_setup64x[.]exe?rlkey=ra0y8p22e5cvcjhk3ai1410ow&st=0tesl0ga&dl=1 | Specific Dropbox-hosted FLEXRAT payload download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/ns0cy91r5q4eekwut9tbv/ChilloutMods_setup64x[.]exe?rlkey=ra0y8p22e5cvcjhk3ai1410ow&st=3sj37sd6&dl=1 | Specific Dropbox-hosted FLEXRAT payload download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/ns0cy91r5q4eekwut9tbv/ChilloutMods_Setup64x[.]exe?rlkey=ra0y8p22e5cvcjhk3ai1410ow&st=ukb7har2&dl=1 | Specific Dropbox-hosted FLEXRAT payload download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/nskicttnk1gpvzl0uhrl3/VrChatPlugins[.]exe?rlkey=39fy70x9tzlkkeafa4oev0vm3&st=z2ewidgv&dl=1 | Specific Dropbox-hosted FLEXRAT payload disguised as VRChat plugins. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/nuecx0f1co2p615wbrt1k/ChilloutVR-ModManager[.]exe?rlkey=vbab0thmbid79pkvtl5va1rxw&st=pv44yyzx&dl=1 | Specific Dropbox-hosted FLEXRAT payload disguised as a mod manager. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/nwo9vhdklyxsfblkp1ws5/ChilloutPlugins[.]zip?rlkey=h4oscctk9xm4b8j7976a4aej2 | Specific Dropbox share link staging a FLEXRAT payload archive. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/otfakqkze127a701il1zh/Vrmod_Setup[.]exe?rlkey=deryztzard7w3n2btuqo7ivvd | Specific Dropbox share link staging a FLEXRAT installer. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/otfakqkze127a701il1zh/Vrmod_Setup[.]exe?rlkey=deryztzard7w3n2btuqo7ivvd&st=48dlc6qm&dl=1 | Specific Dropbox-hosted FLEXRAT installer download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/oylnrqzho0a95nwrfq0kp/ChilloutModPack[.]rar?rlkey=tc9iu840j5n4rk4pnc465twmg&st=wnop3egj&dl=1 | Specific Dropbox-hosted FLEXRAT payload archive download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/pjq11z38imwuarxmnamwi/ChilloutMods_setup64x[.]exe?rlkey=cx8nv5x4s830w7istwjtgcniz&e=1&st=waxs0wz4&dl=1 | Specific Dropbox-hosted FLEXRAT payload download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/qm0tfghcfyx83k87om441/chilloutvrmod[.]rar?rlkey=yarmvsh7zgt4n1hm2114k6ksw&st=weirfjbt&dl=1 | Specific Dropbox-hosted FLEXRAT payload archive download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/reu4jfk9kcwsemndcp17u/ChilloutVrMods[.]zip?rlkey=dt3s5t7cm6g2jrtu6fp041iw6&st=j2d888o6&dl=1 | Specific Dropbox-hosted FLEXRAT payload archive download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/sc4cewcph73x6my6i2btq/Plugins[.]rar?rlkey=xd21ovc3opifve2snjyjn559h&st=rlghroly&dl=1 | Specific Dropbox-hosted FLEXRAT payload archive download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/snh9ge3iws7s63rdfraqa/Chillout-VR-Mod[.]exe?rlkey=gxi36a9jtre43gzs2d08npsu3 | Specific Dropbox share link staging a FLEXRAT payload. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/tcgv7hnv82ozxb6zsb8u8/ChilloutVR-Latest[.]exe?rlkey=lw8xl821mboa0zg2dwmtn1p5t&st=62jbcev6&dl=1 | Specific Dropbox-hosted FLEXRAT payload download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/wc0si9kji4f0lty0dbxey/chiloutvrmod_Setup[.]exe?rlkey=s7877eynqsa1oe339f6zsiybe&e=1&st=t78inqag&dl=1 | Specific Dropbox-hosted FLEXRAT installer download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/xwp3q2qsvvagwixixi5lp/ChilloutModSetup[.]exe?rlkey=e8ehsruyafg87tnl0pd6yxi2a&st=oihbjf9q&dl=1 | Specific Dropbox-hosted FLEXRAT installer download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/yvh12d9y2u2ryvkbfnebx/ChilloutGameSetup[.]exe?rlkey=mum6xl3fisrm6ylwa2chzaokv&st=wgtfrnqe&dl=1 | Specific Dropbox-hosted FLEXRAT installer download. |
| URL | hxxps[:]//www[.]dropbox[.]com/scl/fi/zwhuxivijjxp6aeg2jo0n/ChillOutVRModsInstaller[.]zip?rlkey=4vwm0e516iq4v28q5axs7syum&st=rjveoux7&dl=1 | Specific Dropbox-hosted FLEXRAT payload archive download. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationRecovered JavaScript uses renamed identifiers, rotated string tables, and an XOR string layer keyed with KeshXRD.T1027.013 · Encrypted/Encoded FileThe manifest and protected module bundle are stored in AES-256-GCM encrypted containers.T1036.005 · Match Legitimate Resource Name or LocationThe persistent executable and startup entries impersonate Windows Service Host under %ProgramData%\Microsoft\WindowsServiceHost.T1041 · Exfiltration Over C2 ChannelThe Electron component uploads stolen-data archives and screenshots to the same infrastructure used for remote control.T1053.005 · Scheduled TaskA WindowsServiceHost scheduled task executes at logon with the highest run level.T1057 · Process DiscoveryProcess enumeration supports browser termination checks, security-product discovery, and privileged-token recovery.T1059.001 · PowerShellFLEXRAT uses a hidden PowerShell Start-Process -Verb RunAs command to request elevation.T1059.003 · Windows Command ShellElectron modules perform most actions through child processes launched via cmd.exe, usually with hidden console windows.T1070.004 · File DeletionA recovered SelfDestruct routine deletes the executable or schedules its deletion at reboot.T1071.001 · Web ProtocolsFLEXRAT uses HTTPS routes for device registration, command polling, and result delivery.T1082 · System Information DiscoveryCollected host information includes computer name, Windows build, CPU, GPU, RAM, uptime, and MachineGuid.T1102 · Web ServiceDiscord webhooks and a specific CDN asset support FLEXRAT reporting and report-card delivery.T1106 · Native APIJavaScript reaches Windows credential, process, token, and screen-capture APIs through Koffi bindings.T1112 · Modify RegistryFLEXRAT modifies UAC policy values and creates Run-key persistence values.T1113 · Screen CaptureGDI and GDI+ routines capture desktop screenshots, and remote operators can request screen streaming.T1134.001 · Token Impersonation/TheftCredential-recovery code uses privileged-process PIDs, DuplicateTokenEx, and thread impersonation.T1140 · Deobfuscate/Decode Files or InformationThe loader decrypts data.res, Base64-decodes selected entries, decrypts modules, and inflates JavaScript at runtime.T1204.002 · Malicious FileInfection depends on users running counterfeit ChilloutVR mod or plugin installers.T1497.001 · System ChecksAn apparently unreferenced AntiSandbox utility checks CPU count, RAM, VM adapter prefixes, and analysis-process names.T1518.001 · Security Software DiscoveryFLEXRAT uses tasklist and installation-directory checks to identify antivirus and EDR products.T1528 · Steal Application Access TokenDiscord tokens are recovered from LevelDB stores and process memory, validated, and deduplicated by account.T1539 · Steal Web Session CookieBrowser cookies are collected from databases, headless browser CDP calls, and Network Service process memory.T1547.001 · Registry Run Keys / Startup FolderWindows Service Host values in HKCU and HKLM Run keys launch the persistent executable.T1548.002 · Bypass User Account ControlAfter elevation, FLEXRAT sets ConsentPromptBehaviorAdmin and PromptOnSecureDesktop to 0 to suppress subsequent administrator prompts and the secure desktop.T1552.001 · Credentials In FilesThe implant searches user folders for discord_backup_codes*.txt files containing the account email.T1555.003 · Credentials from Web BrowsersFLEXRAT extracts browser passwords from Chromium browser stores and Firefox, using DPAPI and nss3.dll helpers.T1560 · Archive Collected DataStolen system information, tokens, backup codes, and browser data are assembled into an in-memory ZIP.T1564.001 · Hidden Files and DirectoriesThe persistent executable and its directory receive hidden and system attributes through attrib +h +s.T1567 · Exfiltration Over Web ServiceNative and managed components send collection reports through a Discord webhook.T1583.001 · DomainsThe source reports registration of FLEXRAT, L874, and game-themed lure domains for delivery, reporting, and remote control.T1583.006 · Web ServicesFLEXRAT lure sites also use Netlify and Cloudflare Pages hosting.T1608.001 · Upload MalwareMalicious installers and archives are staged on specific Dropbox share links.T1608.006 · SEO PoisoningCounterfeit mod pages are positioned in search results for ChilloutVR mod and plugin queries.T1622 · Debugger EvasionThe AntiSandbox utility checks for an attached debugger, but researchers found no caller in the recovered modules.
Malware
Vendors
CloudflareOur investigation expanded to more than 100 hostnames spanning distribution candidates, related infrastructure, and contextual resources, hosted across the operator’s own domains as well as Netlify and Cloudflare Pages.DropboxDownload buttons deliver executables and archives hosted on Dropbox.NetlifyOur investigation expanded to more than 100 hostnames spanning distribution candidates, related infrastructure, and contextual resources, hosted across the operator’s own domains as well as Netlify and Cloudflare Pages.
Products
AppLockerUse WDAC or AppLocker to block unsigned executables from user-writable paths such as Downloads, AppData, ProgramData, and Temp, which breaks both the first-stage installer and the persistent copy.BraveIt terminates chrome.exe, brave.exe, msedge.exe, opera.exe (Opera and Opera GX), vivaldi.exe, and browser.exe (Yandex and the conditional Comet build) with taskkill and verifies the termination with tasklist.ChilloutVRThe most prominent lure infrastructure impersonates the ecosystem surrounding ChilloutVR, a legitimate social VR platform, and advertises downloadable mods and plugins purported to extend the game’s functionality.Cloudflare PagesOur investigation expanded to more than 100 hostnames spanning distribution candidates, related infrastructure, and contextual resources, hosted across the operator’s own domains as well as Netlify and Cloudflare Pages.CometIt terminates chrome.exe, brave.exe, msedge.exe, opera.exe (Opera and Opera GX), vivaldi.exe, and browser.exe (Yandex and the conditional Comet build) with taskkill and verifies the termination with tasklist.DiscordThe Electron components carry the core capability set, spanning browser credential collection, Discord token theft, system reconnaissance, screenshot capture, persistence, and remote control.Edgefails to return cookies, a Chrome DevTools Protocol fallback launches an installed Chrome, Brave, or Edge headless and off-screen, navigates to a fixed set of high-value sites (Discord, Google, YouTube, Amazon,ElectronFLEXRAT is a multi-component ecosystem comprising Nim binaries, Go-based loaders, managed .NET components, and NSIS-packaged Electron applications.Google ChromeIt terminates chrome.exe, brave.exe, msedge.exe, opera.exe (Opera and Opera GX), vivaldi.exe, and browser.exe (Yandex and the conditional Comet build) with taskkill and verifies the termination with tasklist.Microsoft WindowsIt establishes ASEP and scheduled task persistence after weakening UAC to elevate, masquerading as a Windows service and hiding its files with the hidden and system attributes.Mozilla FirefoxTwo Python helpers back the decryption paths: a Chromium helper that calls CryptUnprotectData, and a Firefox helper that decrypts through nss3.dll.OperaIt terminates chrome.exe, brave.exe, msedge.exe, opera.exe (Opera and Opera GX), vivaldi.exe, and browser.exe (Yandex and the conditional Comet build) with taskkill and verifies the termination with tasklist.Opera GXIt terminates chrome.exe, brave.exe, msedge.exe, opera.exe (Opera and Opera GX), vivaldi.exe, and browser.exe (Yandex and the conditional Comet build) with taskkill and verifies the termination with tasklist.VivaldiIt terminates chrome.exe, brave.exe, msedge.exe, opera.exe (Opera and Opera GX), vivaldi.exe, and browser.exe (Yandex and the conditional Comet build) with taskkill and verifies the termination with tasklist.VRChatLure infrastructure domain chilloutvrchat.com VRChat-themed lure hostname – –WDACUse WDAC or AppLocker to block unsigned executables from user-writable paths such as Downloads, AppData, ProgramData, and Temp, which breaks both the first-stage installer and the persistent copy.YandexIt terminates chrome.exe, brave.exe, msedge.exe, opera.exe (Opera and Opera GX), vivaldi.exe, and browser.exe (Yandex and the conditional Comet build) with taskkill and verifies the termination with tasklist.