SmartRAT

ThreatLabz observed threat actors using a webpage likely generated with AI to impersonate a Brazilian bank and a ClickFix lure (fake CAPTCHA followed by a fullscreen fake BSOD/system recovery prompt) to pressure victims into running a PowerShell command.

DisplayOverlay : Renders full-screen fake overlays, including Windows Update, BSOD, and bank-branded security screens for major Brazilian banks... dataEntry: : Show a branded bank input form and capture what the victim types

Attempts to establish persistence by creating a logon-triggered scheduled task named MicrosoftEdgeUpdateCore.

Attempts to establish persistence by creating a logon-triggered scheduled task named MicrosoftEdgeUpdateCore.

Execution T1059 Command and Scripting Interpreter Use built-in interpreters (like PowerShell) to run malicious commands/scripts.

If a user pastes it into the Windows run command, the command will download and execute the next stage by retrieving st.txt from 64[.]95[.]13[.]238... The decrypted blob is a PowerShell RAT that ThreatLabz named SmartRAT.

If UAC elevation is approved: SmartRAT compiles inline C# service code using csc.exe and installs a Windows service named MicrosoftEdgeUpdateCore under %ProgramData%\Microsoft\Diagnosis\ETW. This service is configured to run with System privileges.

Attempts to establish persistence by creating a logon-triggered scheduled task named MicrosoftEdgeUpdateCore.

Attempts to establish persistence by creating a logon-triggered scheduled task named MicrosoftEdgeUpdateCore.

Attempts to establish persistence by creating a logon-triggered scheduled task named MicrosoftEdgeUpdateCore... If UAC elevation is approved: SmartRAT compiles inline C# service code using csc.exe and installs a Windows service named MicrosoftEdgeUpdateCore... configured to run with System privileges.

If task creation fails, it falls back to registry-based persistence by writing a MicrosoftEdgeUpdateCore value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run that launches a PowerShell command to re-execute SmartRAT.

Attempts to establish persistence by creating a logon-triggered scheduled task named MicrosoftEdgeUpdateCore.

Attempts to establish persistence by creating a logon-triggered scheduled task named MicrosoftEdgeUpdateCore.

SmartRAT also compiles another C# component that uses DuplicateTokenEx and CreateProcessAsUser to spawn a new PowerShell process using the current user’s session, even when the RAT is running as SYSTEM.

Attempts to establish persistence by creating a logon-triggered scheduled task named MicrosoftEdgeUpdateCore... If UAC elevation is approved: SmartRAT compiles inline C# service code using csc.exe and installs a Windows service named MicrosoftEdgeUpdateCore... configured to run with System privileges.

If task creation fails, it falls back to registry-based persistence by writing a MicrosoftEdgeUpdateCore value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run that launches a PowerShell command to re-execute SmartRAT.

Prompts for User Account Control (UAC) elevation. If UAC elevation is approved... installs a Windows service... If UAC elevation is denied... launches a hidden PowerShell process that bypasses the UAC logic and beacons to the C2.

SmartRAT decrypts two C2 server configurations. The first is decrypted using XOR with the key 2... The fallback C2 is an IP address that is decrypted using XOR with the key 233.

Defense Evasion T1036 Masquerading Masquerade artifacts (e.g., rename malware to svchost.exe) to appear legitimate and evade monitoring.

0xA2 SystemCommand... uninstall: Complete self-removal; delete the service, scheduled tasks, registry keys, and all files, then exit.

SmartRAT also compiles another C# component that uses DuplicateTokenEx and CreateProcessAsUser to spawn a new PowerShell process using the current user’s session, even when the RAT is running as SYSTEM.

The malware uses the port number 51888 for communication. SmartRAT also hides the running PowerShell window using user32.dll’s ShowWindow function.

NativeInput: Handles mouse and keyboard inputs, including freezing the victim's input.

InputTracker: A high-priority keylogger that monitors all keystrokes... 0x70 InputTrackStart Start keylogger thread.

0xB3 ServiceList Return list of Windows services.

0xB2 ProcessList Return list of running processes.

GuestInfo (type 0xE6) Sends victim profile JSON (OS, username, host, privilege, session ID, install token, HMAC).

0x50 FileList Browse the victim's filesystem.

NativeInput: Handles mouse and keyboard inputs, including freezing the victim's input.

InputTracker: A high-priority keylogger that monitors all keystrokes... 0x70 InputTrackStart Start keylogger thread.

Automatic screen streaming: Captures and streams screenshots to the operator at configurable intervals.

0x40 Clipboard Copy content to the victim’s clipboard (can be AES-encrypted).

The encryption and decryption of C2 command traffic is handled by the following two functions... Uses AES-CBC to encrypt plaintext... The IV and ciphertext are each hex-encoded separately and returned as a colon-delimited string.

Command and Control T1071 Application Layer Protocol Use standard protocols (HTTP/DNS/SMB) for C2 to blend with normal traffic.

SmartRAT is a PowerShell-based banking RAT used for remote access and financial data theft... supports encrypted C2 communications, remote control (screen/keyboard/mouse).

The information captured in the overlay form is then exfiltrated to the SmartRAT C2... 0x54 FileDownload Exfiltrate a file (up to 50MB).