New STX RAT Uses Hidden Remote Desktop and Infostealer Features to Evade Detection

The article discusses a new variant of the STX RAT (Remote Access Trojan) that has been updated with advanced capabilities, particularly focusing on its use of hidden remote desktop functionalities and infostealer features to evade detection. Here are the key points:

1. Advanced Capabilities:

   • The new version of STX RAT includes a hidden remote desktop feature called HVNC (Hidden Virtual Network Computing), which allows attackers to control compromised systems without being detected by users.

2. Detection Challenges:

   • Due to its stealthy nature, the malware is difficult for security tools and analysts to detect.
   • The use of hidden sessions makes it hard to identify ongoing malicious activities.

3. Infection Mechanism:

   • STX RAT spreads through VBScript or JScript files dropped in temporary directories.
   • It uses PowerShell STDIN executions to inject itself into the system, making it harder to trace back to initial infection vectors.

4. Command and Control (C2) Infrastructure:

   • The malware communicates with a known C2 server at IP address 95.216.51.236.
   • It also uses an associated Tor onion service for command-and-control communications, adding

Read the full article at Cyber Security News

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.