Loading malware…
STX RAT is a remote access trojan (RAT) with infostealer capabilities, first documented in 2026 and named for the Start of Text (STX, 0x02) magic byte prefixed to its C2 messages. It has been observed in multiple delivery chains, including browser-downloaded VBScript/JScript and PowerShell loaders, trojanized FileZilla installers, trojanized cryptocurrency- and software-themed installers, and watering-hole/supply-chain compromises involving CPUID software such as CPU-Z, HWMonitor, HWMonitor Pro, and PerfMonitor. Across several campaigns, attackers used DLL sideloading via a malicious CRYPTBASE.dll placed beside legitimate signed executables; the DLL launched a multi-stage unpacking chain using XXTEA decryption, zlib decompression, reflective loading, and in-memory execution, often leaving minimal disk artifacts after the initial DLL stage.
Observed capabilities include remote access and command execution, hidden virtual desktop/HVNC functionality, execution of follow-on EXE, DLL, PowerShell, and shellcode payloads in memory, screenshot capture, collection of host metadata, running process and security-product enumeration, clipboard collection, and theft of saved browser credentials, cookies/session tokens, Windows Vault data, FTP client credentials, and cryptocurrency wallet data. Reported targeted applications and data sources include Firefox, SeaMonkey, Chromium-based browsers, FileZilla, WinSCP, Cyberduck, and several desktop cryptocurrency wallets. Persistence mechanisms reported across analyses include HKCU Run/registry autoruns, scheduled tasks, COM/TypeLib hijacking, autorun PowerShell scripts, and MSBuild project execution.
STX RAT includes anti-analysis and evasion features such as debugger and PEB checks, anti-VM/sandbox checks for VirtualBox, VMware, and QEMU artifacts, AMSI bypass/ghosting behavior, API hashing, string obfuscation, and delayed or gated credential theft pending C2 instruction. Its C2 communications have been reported over HTTPS and also via a custom encrypted protocol using X25519 ECDH and ChaCha20-Poly1305; some reporting also notes DNS-over-HTTPS usage in associated campaigns. Infrastructure repeatedly linked to STX RAT campaigns includes the supp0v3[.]com domain family, especially welcome.supp0v3[.]com and helloworld.supp0v3[.]com, with related campaigns tied to a Bitbucket repository named amos-trading and an actor alias tracked as Leda Elacoate. Victims reported in public campaigns included private individuals and organizations in financial services, retail, manufacturing, consulting, telecommunications, and agriculture, with notable infection concentrations in Brazil, Russia, and China. High-confidence indicators directly mentioned in the content include welcome.supp0v3[.]com/d/callback, helloworld.supp0v3[.]com, supp0v3[.]com, C2 IP 95.216.51.236, download/backend IP 147.45.178.61, and repeated use of malicious CRYPTBASE.dll sideloading.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
A malicious CRYPTBASE.dll gets sideloaded alongside the legitimate installer, kicking off what the report calls an identical multi-stage unpack chain that loads STX RAT in memory.
57 distinct techniques documented for this family, organized by ATT&CK tactic.
On April 9, 2026, the website cpuid[.]com... was compromised... the legitimate download URLs for installers of those software tools were replaced with URLs to... malicious websites.
A Month-Long Supply Chain Operation Targets Crypto Users... the operation began with cryptocurrency trading tools and expanded into a VPN client used by over 100 million people worldwide.
MITRE ATT&CK Tactic Technique ID Description Initial Access T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
Indicators of persistence: Uses Software\Microsoft\Windows\CurrentVersion\Run (nRun), scheduled tasks (Unregister-ScheduledTask)
As part of persistence, a scheduled task is created with the parameter <Hidden>true</Hidden> in the <Task Content> field...
Multi-stage scripts that enable privilege escalation and in-memory execution have been utilized to distribute the STX RAT
During the creation of a PowerShell child process and redirection of its output to a pipe for writing the payload, several rules are triggered...
TRU observed attempted delivery of the malware via a browser-downloaded VBScript file... The VBScript concatenates JScript contents, writes them to a JScript file on disk, and executes the JScript file via WScript with elevated privileges.
The VBScript concatenates JScript contents, writes them to a JScript file on disk, and executes the JScript file via WScript with elevated privileges.
The malicious DLL extracts obfuscated data from its .rdata section, allocates executable memory using VirtualAlloc, and passes execution through several decryption stages before reaching the final payload.
Attempts to establish persistence through the registry autorun key and the loading further of a payload using standard system utilities are detected by... R423_02_Compilation via csc.exe from suspicious location.
Attempts to establish persistence through the registry autorun key and the loading further of a payload using standard system utilities are detected by... R423_03_Suspicious msbuild utility execution.
The researchers said the malware relies on opportunistic delivery methods, including browser-downloaded scripts and trojanized installers, to gain initial access.
MITRE ATT&CK Tactic Technique ID Description ... Execution T1204.002 User Execution: Malicious File
Tactic Technique ID Detail Execution Inter-Process Communication T1559 PowerShell stdin piping to avoid cmdline logging
Around April 9 to 10, CPUID’s side API was reportedly hijacked so official CPU-Z, HWMonitor, and PerfMonitor links pointed to attacker-controlled Cloudflare R2 buckets, while the signed binaries themselves remained legitimate.
A malicious CRYPTBASE.dll gets sideloaded alongside the legitimate installer, kicking off what the report calls an identical multi-stage unpack chain that loads STX RAT in memory.
Indicators of persistence: Uses Software\Microsoft\Windows\CurrentVersion\Run (nRun), scheduled tasks (Unregister-ScheduledTask)
As part of persistence, a scheduled task is created with the parameter <Hidden>true</Hidden> in the <Task Content> field...
To detect COM Hijacking of the IScriptControl object, we recommend configuring a rule for writing to the Default key of the registry branch \Software\Classes\TypeLib{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}...
Attempts to establish persistence through the registry autorun key... are detected by the following rules: R097_01_Change of startup script settings through the Windows registry.
Indicators of persistence: Uses Software\Microsoft\Windows\CurrentVersion\Run (nRun), scheduled tasks (Unregister-ScheduledTask)
As part of persistence, a scheduled task is created with the parameter <Hidden>true</Hidden> in the <Task Content> field...
Flag 0x04 (line 178) copies secondaryPayload into RWX memory and executes it as shellcode in a worker thread.
To detect COM Hijacking of the IScriptControl object, we recommend configuring a rule for writing to the Default key of the registry branch \Software\Classes\TypeLib{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}...
Attempts to establish persistence through the registry autorun key... are detected by the following rules: R097_01_Change of startup script settings through the Windows registry.
Tactic Technique ID Detail Defense Evasion Abuse Elevation Control: Bypass UAC T1548.002 consent.exe invoked (Dr.Web sandbox)
MITRE ATT&CK Tactic Technique ID Description ... Defense Evasion T1027 Obfuscated Files or Information
Lines 17-18 resolve kernel32.dll... via GetModuleHandleByHash, then resolve VirtualProtect... via GetProcAddressByHash... Line 21 resolves WaitForSingleObject...
MITRE ATT&CK Tactic Technique ID Description ... Defense Evasion T1027.009 Obfuscated Files or Information: Embedded Payloads
By early March, Malwarebytes reported a separate campaign spreading STX RAT through trojanized FileZilla installers, confirming the operators were already running multiple delivery methods simultaneously.
MITRE ATT&CK Tactic Technique ID Description ... Defense Evasion T1036.005 Masquerading: Match Legitimate Name or Location
MITRE ATT&CK Tactic Technique ID Description ... Defense Evasion T1036.008 Masquerading: Masquerade File Type
Flag 0x04 (line 178) copies secondaryPayload into RWX memory and executes it as shellcode in a worker thread.
Tactic Technique ID Detail Defense Evasion Indicator Removal: File Deletion T1070.004 Self-delete behavior
Attempts to establish persistence through the registry autorun key and the loading further of a payload using standard system utilities are detected by... R423_02_Compilation via csc.exe from suspicious location.
Attempts to establish persistence through the registry autorun key and the loading further of a payload using standard system utilities are detected by... R423_03_Suspicious msbuild utility execution.
This is the main glue which encapsulates decryption, decompression and then launches the next stage payload. Line 12 calls decryptPayloadXXTEA on the encryptedBlob... Line 14 calls zlibDecompress, decompressing the encryptedBlob into payloadBuffer.
Subsequent execution of the .sct scriptlet through the scrobj.dll library is detected by the rule R291_04_Executing commands using regsvr32.exe.
Prior to this, it also performs a set of anti-sandbox checks and, if all the checks have passed, it connects to the C2 server.
Registry checks for sandbox presence can be detected by the rule R227_01_Collecting of information about virtual machines through the Windows registry.
Based on dynamic analysis results, the analyzed sample was found to perform the following malicious actions: Introduce a time delay for deferred payload execution
Line 159 calls hideWindow which hides the RAT’s window using SW_HIDE and WS_EX_TOOLWINDOW... Flag 0x02 (line 174) hides the RAT’s window from the taskbar.
Around April 9 to 10, CPUID’s side API was reportedly hijacked so official CPU-Z, HWMonitor, and PerfMonitor links pointed to attacker-controlled Cloudflare R2 buckets, while the signed binaries themselves remained legitimate.
A malicious CRYPTBASE.dll gets sideloaded alongside the legitimate installer, kicking off what the report calls an identical multi-stage unpack chain that loads STX RAT in memory.
It loads entirely in memory via reflective injection, leaving no file artifacts on disk after the initial sideloaded DLL executes.
The RAT checks the Process Environment Block for a debugger flag to detect analysis tools.
Based on dynamic analysis results, the analyzed sample was found to perform the following malicious actions: Modify AMSI to bypass antivirus protection (AMSI patching)
Its capabilities extend to harvesting sensitive information from browsers, FTP clients and cryptocurrency wallets.
Once active, it can harvest saved browser credentials, session tokens, and clipboard data, while giving an operator ongoing remote control of the infected machine.
Once active, it can harvest saved browser credentials, session tokens, and clipboard data, while giving an operator ongoing remote control of the infected machine.
Broad infostealer capabilities, targeting browser credentials/cookies ... Firefox/SeaMonkey browser cookies and passwords. Chromium-based browser cookies/passwords
Windows Vault credentials via Windows APIs: VaultEnumerateVaults, VaultOpenVault, VaultEnumerateItems, VaultGetItem, VaultFree, VaultCloseVault
It silently captures screenshots, collects hostname, username, and OS details...
Prior to this, it also performs a set of anti-sandbox checks and, if all the checks have passed, it connects to the C2 server.
Registry checks for sandbox presence can be detected by the rule R227_01_Collecting of information about virtual machines through the Windows registry.
Based on dynamic analysis results, the analyzed sample was found to perform the following malicious actions: Introduce a time delay for deferred payload execution
It also enumerates installed security products including antivirus and EDR solutions such as Avast, Bitdefender, SentinelOne, and CarbonBlack.
The RAT checks the Process Environment Block for a debugger flag to detect analysis tools.
STX RAT waits for command server instructions before pilfering browser, FTP client, and cryptocurrency wallet data
Its capabilities extend to harvesting sensitive information from browsers, FTP clients and cryptocurrency wallets.
Once the RAT is active on a machine, attackers gain the ability to monitor and capture the victim’s screen... It silently captures screenshots...
Once active, it can harvest saved browser credentials, session tokens, and clipboard data, while giving an operator ongoing remote control of the infected machine.
All communication happens over HTTPS, blending in with normal traffic.
C2 over HTTPS. All outbound traffic uses standard web protocols, blending with normal browsing activity and avoiding port-based detection.
The trojanized packages carried a malicious CRYPTBASE.dll, which sideloaded a reflective loader and then STX RAT, with persistence and DoH-based C2.
STX RAT "exposes a broad command set for remote control, follow-on payload execution, and post-exploitation actions (e.g., in-memory execution of EXE/DLL/PowerShell/shellcode, reverse proxy/tunneling, desktop interaction)"
Tactic Technique ID Detail Command and Control Proxy: External Proxy T1090.002 Cloudflare CDN as reverse proxy; Caddy backend
Tactic Technique ID Detail Command and Control Web Service: Bidirectional Communication T1102.002 Cloudflare R2 object storage for payload distribution
The trojanized bundles were hosted in a Bitbucket repository, amos-trading/dist-internal... each new package added roughly every few days before the entire crypto-focused lineup was deleted and replaced by X-VPN.zip in the final commit.
STX RAT is a remote access trojan with infostealer capabilities. Once active, it can harvest saved browser credentials, session tokens, and clipboard data, while giving an operator ongoing remote control of the infected machine.
Tactic Technique ID Detail Command and Control Encrypted Channel: Asymmetric Cryptography T1573.002 HTTPS C2 communication
Line 161 calls exfiltrateCollectedData which packages data from the populated globals with a decoded keyword and sends it to the C2 server.
179 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.