Cybersecurity researchers have disclosed a stealthy new backdoor referred to as MystRodX that comes with a wide range of options to seize delicate knowledge from compromised programs.
“MystRodX is a typical backdoor carried out in C++, supporting options like file administration, port forwarding, reverse shell, and socket administration,” QiAnXin XLab stated in a report printed final week. “In comparison with typical backdoors, MystRodX stands out by way of stealth and suppleness.”
MystRodX, additionally referred to as ChronosRAT, was first documented by Palo Alto Networks Unit 42 final month in reference to a risk exercise cluster referred to as CL-STA-0969 that it stated displays overlaps with a China-nexus cyber espionage group dubbed Liminal Panda.
The malware’s stealth stems from using numerous ranges of encryption to obscure supply code and payloads, whereas its flexibility permits it to dynamically allow totally different features primarily based on a configuration, similar to selecting TCP or HTTP for community communication, or choosing plaintext or AES encryption to safe community visitors.
MystRodX additionally helps what’s referred to as a wake-up mode, thereby enabling it to perform as a passive backdoor that may be triggered following the receipt of specifically crafted DNS or ICMP community packets from incoming visitors. There’s proof to counsel that the malware might have been round since not less than January 2024, primarily based on an activation timestamp set within the configuration.
“Magic worth is verified, MystRodX establishes communication with the C2 [command-and-control] utilizing the required protocol and awaits additional instructions,” XLab researchers stated. “In contrast to well-known stealth backdoors like SYNful Knock, which manipulates TCP header fields to cover instructions, MystRodX makes use of a less complicated but efficient strategy: it hides activation directions immediately within the payload of ICMP packets or inside DNS question domains.”
The malware is delivered by the use of a dropper that makes use of a spate of debugger- and digital machine-related checks to find out if the present course of is being debugged or it is being run inside a virtualized atmosphere. As soon as the validation step is full, the next-stage payload is decrypted. It incorporates three parts –
- daytime, a launcher liable for launching chargen
- chargen, the MystRodX backdoor element, and
- busybox
MystRodX, as soon as executed, constantly screens the daytime course of, and if it isn’t discovered to be working, instantly launches it. Its configuration, which is encrypted utilizing the AES algorithm, incorporates info pertaining to the C2 server, backdoor sort, and predominant and backup C2 ports.
“When the Backdoor Sort is ready to 1, MystRodX enters passive backdoor mode and waits for an activation message,” XLab stated. “When the worth of Backdoor Sort will not be 1, MystRodX enters lively backdoor mode and establishes communication with the C2 specified within the configuration, ready to execute the acquired instructions.”
