Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

XenoRAT Adopts Excel XLL Files and ConfuserEx as Access Method

hunt.io | blog | #phishing | #rat | #malware-delivery | #xenorat | #microsoft-excel | #confuserex

Summary

Hunt.io analyzes a XenoRAT sample delivered as a ConfuserEx-protected Excel XLL titled 'Payment Details'—a shift from the RAT's gaming fare toward enterprise targets and financial lures.
Published
Collected

original ↗

Related coverage

blog · hunt.io
Uncovering Threat Actor Tactics: How Open Directories Provide Insight into XWorm Delivery Strategies
Using open directories, Hunt.io shows how XWorm RAT samples masquerade as browsers, security tools and file-transfer apps—including a lone SecurityHealthService.exe on a Thai-hosted server.
blog · hunt.io
Malicious VSCode Extension Launches Multi-Stage Attack Chain with Anivia Loader and OctoRAT
A fake 'prettier-vscode-plus' extension on the official VSCode Marketplace delivered the Anivia loader and OctoRAT—a RAT with 70+ commands—in a supply-chain attack that rotated payloads.
blog · hunt.io
Paste.ee Abuse Uncovered: XWorm & AsyncRAT Infrastructure
An obfuscated JavaScript downloader abusing paste.ee to stage payloads leads researchers to XWorm and AsyncRAT C2 infrastructure, with regex and SSL detection guidance for defenders.
blog · hunt.io
Proactive ClickFix Threat Hunting with Hunt.io
A case study in proactively hunting ClickFix delivery pages: custom HuntSQL queries surface live, previously unreported malicious domains behind the Windows Run-dialog clipboard trick.
blog · hunt.io
Unmasking SparkRAT: Detection & macOS Campaign Insights
Hunt.io details how to spot SparkRAT servers via default port 8000 and HTTP Basic auth banners, and examines a suspected DPRK macOS campaign tied to the Golang RAT's WebSocket C2 traffic.
blog · hunt.io
RunningRAT’s Next Move: From Remote Access to Crypto mining For Profit
Hunt.io spots RunningRAT—previously an access and data-theft tool linked to 2018 Olympics campaigns—now staging crypto-mining payloads via open directories and a separate staging VPS.
back