CloudZ RAT

A Windows scheduled task is created to establish persistence and ultimately execute the loader.

then attempts to use the Invoke-WebRequest PowerShell command

CloudZ can perform various command received from its C2 server including shell command execution

A Windows scheduled task is created to establish persistence and ultimately execute the loader.

A Windows scheduled task is created to establish persistence and ultimately execute the loader.

The CloudZ RAT is delivered as a .NET executable that is obfuscated using a tool called ConfuserEx.

the execution of a dropper disguised as a ScreenConnect update led to the installation and execution of a .NET loader... The .NET loader is disguised as a text file with names including “update.txt” and “msupdate.txt”

First, it attempts to use the curl utility... then finally attempts to use the Windows “bitsadmin” tool to install the plugin.

Prior to deploying CloudZ, the loader performs anti-analysis checks including a check for the elapsed time of a sleep command... It also verifies the presence of at least two processor cores and searches for the strings “virtual” and “sandbox” in the system directory path, computer name, user domain and victim username

a comparison between running processes and a hard-coded list of security tools including Wireshark, Fiddler, Procmon and Sysmon. It also verifies the presence of at least two processor cores

CloudZ also performs its own anti-analysis checks, including by querying the _ENABLE_PROFILING environment variable for signs of a .NET profiler or debugger being attached to the malware’s process.

The malware is capable of stealing credentials from browser data to exfiltrate to its command-and-control (C2) server

The Pheno plugin identifies whether a mobile device is currently synced via Phone Link by scanning running process for keywords including “YourPhone, “PhoneExperienceHost” and “Link to Windows.”

Prior to deploying CloudZ, the loader performs anti-analysis checks including a check for the elapsed time of a sleep command... It also verifies the presence of at least two processor cores and searches for the strings “virtual” and “sandbox” in the system directory path, computer name, user domain and victim username

a comparison between running processes and a hard-coded list of security tools including Wireshark, Fiddler, Procmon and Sysmon. It also verifies the presence of at least two processor cores

CloudZ also performs its own anti-analysis checks, including by querying the _ENABLE_PROFILING environment variable for signs of a .NET profiler or debugger being attached to the malware’s process.

intercepting files from the SQLite database where Phone Link stores notification, SMS and call history. This could allow for the extraction of sensitive information from text messages and applications, including OTPs.

It logs the process IDs and file paths of matching processes to a file named “phonelink-[COMPUTERNAME].txt” and places these files at C:\programdata\Microsoft\feedback\cm and %TEMP%\Microsoft\feedback\cm.

CloudZ can perform various command received from its C2 server including... screen recording

The RAT decrypts one set of embedded configuration data and retrieves secondary configuration data from external sources, including Pastebin URLs and Cloudflare Workers.

It uses three different methods to download externally hosted plugins, falling back to subsequent methods if earlier methods fail. First, it attempts to use the curl utility, then attempts to use the Invoke-WebRequest PowerShell command, then finally attempts to use the Windows “bitsadmin” tool to install the plugin.