Cybersecurity researchers have disclosed a stealthy new backdoor known as MystRodX that comes with a wide range of options to seize delicate knowledge from compromised techniques.
“MystRodX is a typical backdoor carried out in C++, supporting options like file administration, port forwarding, reverse shell, and socket administration,” QiAnXin XLab mentioned in a report revealed final week. “In comparison with typical backdoors, MystRodX stands out when it comes to stealth and suppleness.”
MystRodX, additionally known as ChronosRAT, was first documented by Palo Alto Networks Unit 42 final month in reference to a menace exercise cluster known as CL-STA-0969 that it mentioned displays overlaps with a China-nexus cyber espionage group dubbed Liminal Panda.
The malware’s stealth stems from using varied ranges of encryption to obscure supply code and payloads, whereas its flexibility permits it to dynamically allow completely different features primarily based on a configuration, corresponding to selecting TCP or HTTP for community communication, or choosing plaintext or AES encryption to safe community visitors.
MystRodX additionally helps what’s known as a wake-up mode, thereby enabling it to operate as a passive backdoor that may be triggered following the receipt of specifically crafted DNS or ICMP community packets from incoming visitors. There may be proof to recommend that the malware might have been round since not less than January 2024, primarily based on an activation timestamp set within the configuration.
“Magic worth is verified, MystRodX establishes communication with the C2 [command-and-control] utilizing the desired protocol and awaits additional instructions,” XLab researchers mentioned. “Not like well-known stealth backdoors like SYNful Knock, which manipulates TCP header fields to cover instructions, MystRodX makes use of a less complicated but efficient strategy: it hides activation directions straight within the payload of ICMP packets or inside DNS question domains.”
The malware is delivered by the use of a dropper that makes use of a spate of debugger- and digital machine-related checks to find out if the present course of is being debugged or it is being run inside a virtualized setting. As soon as the validation step is full, the next-stage payload is decrypted. It comprises three parts –
- daytime, a launcher chargeable for launching chargen
- chargen, the MystRodX backdoor element, and
- busybox
MystRodX, as soon as executed, constantly screens the daytime course of, and if it’s not discovered to be working, instantly launches it. Its configuration, which is encrypted utilizing the AES algorithm, comprises data pertaining to the C2 server, backdoor sort, and principal and backup C2 ports.
“When the Backdoor Kind is about to 1, MystRodX enters passive backdoor mode and waits for an activation message,” XLab mentioned. “When the worth of Backdoor Kind is just not 1, MystRodX enters lively backdoor mode and establishes communication with the C2 specified within the configuration, ready to execute the obtained instructions.”