Loading malware…
STX RAT is a remote access trojan (RAT) with infostealer capabilities, first documented in 2026 and named for the Start of Text (STX, 0x02) magic byte prefixed to its C2 messages. It has been observed in multiple delivery chains, including browser-downloaded VBScript/JScript and PowerShell loaders, trojanized FileZilla installers, trojanized cryptocurrency- and software-themed installers, and watering-hole/supply-chain compromises involving CPUID software such as CPU-Z, HWMonitor, HWMonitor Pro, and PerfMonitor. Across several campaigns, attackers used DLL sideloading via a malicious CRYPTBASE.dll placed beside legitimate signed executables; the DLL launched a multi-stage unpacking chain using XXTEA decryption, zlib decompression, reflective loading, and in-memory execution, often leaving minimal disk artifacts after the initial DLL stage.
Observed capabilities include remote access and command execution, hidden virtual desktop/HVNC functionality, execution of follow-on EXE, DLL, PowerShell, and shellcode payloads in memory, screenshot capture, collection of host metadata, running process and security-product enumeration, clipboard collection, and theft of saved browser credentials, cookies/session tokens, Windows Vault data, FTP client credentials, and cryptocurrency wallet data. Reported targeted applications and data sources include Firefox, SeaMonkey, Chromium-based browsers, FileZilla, WinSCP, Cyberduck, and several desktop cryptocurrency wallets. Persistence mechanisms reported across analyses include HKCU Run/registry autoruns, scheduled tasks, COM/TypeLib hijacking, autorun PowerShell scripts, and MSBuild project execution.
STX RAT includes anti-analysis and evasion features such as debugger and PEB checks, anti-VM/sandbox checks for VirtualBox, VMware, and QEMU artifacts, AMSI bypass/ghosting behavior, API hashing, string obfuscation, and delayed or gated credential theft pending C2 instruction. Its C2 communications have been reported over HTTPS and also via a custom encrypted protocol using X25519 ECDH and ChaCha20-Poly1305; some reporting also notes DNS-over-HTTPS usage in associated campaigns. Infrastructure repeatedly linked to STX RAT campaigns includes the supp0v3[.]com domain family, especially welcome.supp0v3[.]com and helloworld.supp0v3[.]com, with related campaigns tied to a Bitbucket repository named amos-trading and an actor alias tracked as Leda Elacoate. Victims reported in public campaigns included private individuals and organizations in financial services, retail, manufacturing, consulting, telecommunications, and agriculture, with notable infection concentrations in Brazil, Russia, and China. High-confidence indicators directly mentioned in the content include welcome.supp0v3[.]com/d/callback, helloworld.supp0v3[.]com, supp0v3[.]com, C2 IP 95.216.51.236, download/backend IP 147.45.178.61, and repeated use of malicious CRYPTBASE.dll sideloading.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The same IP was used for earlier .url shortcut exploits (CVE-2023-36025 SmartScreen bypass) targeting LibreOffice and Google Drive downloads, sharing VBS payloads via WebDAV.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A malicious CRYPTBASE.dll gets sideloaded alongside the legitimate installer, kicking off what the report calls an identical multi-stage unpack chain that loads STX RAT in memory.
34 distinct techniques documented for this family, organized by ATT&CK tactic.
On April 9, 2026, the website cpuid[.]com... was compromised... the legitimate download URLs for installers of those software tools were replaced with URLs to... malicious websites.
As part of persistence, a scheduled task is created with the parameter <Hidden>true</Hidden> in the <Task Content> field...
During the creation of a PowerShell child process and redirection of its output to a pipe for writing the payload, several rules are triggered...
The malicious DLL extracts obfuscated data from its .rdata section, allocates executable memory using VirtualAlloc, and passes execution through several decryption stages before reaching the final payload.
Attempts to establish persistence through the registry autorun key and the loading further of a payload using standard system utilities are detected by... R423_02_Compilation via csc.exe from suspicious location.
Attempts to establish persistence through the registry autorun key and the loading further of a payload using standard system utilities are detected by... R423_03_Suspicious msbuild utility execution.
As part of persistence, a scheduled task is created with the parameter <Hidden>true</Hidden> in the <Task Content> field...
As part of persistence, a scheduled task is created with the parameter <Hidden>true</Hidden> in the <Task Content> field...
MITRE ATT&CK Tactic Technique ID Description ... Defense Evasion T1027 Obfuscated Files or Information
MITRE ATT&CK Tactic Technique ID Description ... Defense Evasion T1027.009 Obfuscated Files or Information: Embedded Payloads
MITRE ATT&CK Tactic Technique ID Description ... Defense Evasion T1036.005 Masquerading: Match Legitimate Name or Location
MITRE ATT&CK Tactic Technique ID Description ... Defense Evasion T1036.008 Masquerading: Masquerade File Type
Attempts to establish persistence through the registry autorun key and the loading further of a payload using standard system utilities are detected by... R423_02_Compilation via csc.exe from suspicious location.
Attempts to establish persistence through the registry autorun key and the loading further of a payload using standard system utilities are detected by... R423_03_Suspicious msbuild utility execution.
Subsequent execution of the .sct scriptlet through the scrobj.dll library is detected by the rule R291_04_Executing commands using regsvr32.exe.
Prior to this, it also performs a set of anti-sandbox checks and, if all the checks have passed, it connects to the C2 server.
Registry checks for sandbox presence can be detected by the rule R227_01_Collecting of information about virtual machines through the Windows registry.
Based on dynamic analysis results, the analyzed sample was found to perform the following malicious actions: Introduce a time delay for deferred payload execution
A malicious CRYPTBASE.dll gets sideloaded alongside the legitimate installer, kicking off what the report calls an identical multi-stage unpack chain that loads STX RAT in memory.
It silently captures screenshots, collects hostname, username, and OS details...
Prior to this, it also performs a set of anti-sandbox checks and, if all the checks have passed, it connects to the C2 server.
Registry checks for sandbox presence can be detected by the rule R227_01_Collecting of information about virtual machines through the Windows registry.
Based on dynamic analysis results, the analyzed sample was found to perform the following malicious actions: Introduce a time delay for deferred payload execution
All communication happens over HTTPS, blending in with normal traffic.
C2 over HTTPS. All outbound traffic uses standard web protocols, blending with normal browsing activity and avoiding port-based detection.
The trojanized packages carried a malicious CRYPTBASE.dll, which sideloaded a reflective loader and then STX RAT, with persistence and DoH-based C2.
179 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan with infostealer capabilities that harvests saved browser credentials, session tokens, and clipboard data while providing ongoing remote control of the infected machine. It communicates over HTTPS and runs entirely in memory after DLL sideloading.
An in-memory remote access trojan with infostealer capabilities. It is delivered via malicious CRYPTBASE.dll sideloading, uses reflective injection, provides remote command execution, steals browser credentials and session tokens, collects system/process/clipboard data, and communicates with C2 over HTTPS.
An in-memory remote access trojan with infostealer capabilities. It is delivered via DLL sideloading using a malicious CRYPTBASE.dll, performs reflective injection, enables remote command execution, steals browser credentials and session tokens, collects system/process/clipboard data, and communicates with C2 over HTTPS while leaving no on-disk persistence.
STX RAT is a remote access trojan delivered via DLL sideloading using a trojanized HWMonitor package. It is loaded through a multi-stage reflective in-memory chain and is used for long-term surveillance and data theft, including screenshot capture, system information collection, security product enumeration, persistence, and HTTPS-based C2 communications using JSON messages.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.