Trojan.BAT.LXRAT.A

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

It does not have any information-stealing capability.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• %User Temp%\svc_{random}.ps1 → Hidden-relaunch helper script that respawns the BAT with a hidden console window; deleted afterwards
• %User Temp%\{random}.bat → Decrypted Stage 1 inner dropper; deleted afterwards
• %User Temp%\khost_{random}.ps1 → PowerShell launcher that decrypts and reflectively loads the OmniCascade injector (.NET DLL; detected as Trojan.MSIL.INJECTOR.F) and LX-CLIENT.app RAT (.NET EXE; detected as Backdoor.MSIL.LXRAT.A); deleted afterwards

It adds the following processes:

• cmd.exe /c find /c /v "" < "{malware path}\{malware filename}" → Counts total lines in the BAT to calculate extraction offsets
• cmd.exe /c findstr /n /C:"→-BEGIN_PS→-" "{malware path}\{malware filename}" → Locates the PowerShell payload marker line number
• cmd.exe /c findstr /n /C:"→-BEGIN_ENC→-" "{malware path}\{malware filename}" → Locates the encrypted data marker line number
• powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-Content '{malware path}\{malware filename}' -Tail {N} | Select-Object -First {M} | Set-Content '%User Temp%\svc_{random}.ps1' -Encoding UTF8" → Extracts the hidden-relaunch helper script by line offset
• powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "%User Temp%\svc_{random}.ps1" → Executes the hidden-relaunch helper, which decrypts Stage 1 BAT and launches it
• cmd.exe /c "%User Temp%\{random}.bat" __hidden → Executes the decrypted Stage 1 inner BAT
• powershell -WindowStyle Hidden -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command "{hidden relaunch of Stage 1 BAT via ProcessStartInfo}" → Stage 1 re-executes itself with a hidden window
• powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "%User Temp%\khost_{random}.ps1" → Executes the payload launcher (loads OmniCascade injector + RAT and performs process hollowing)
• %System%\csc.exe /noconfig /fullpaths @"%User Temp%\{random}\{random}.cmdline" → C# compiler invoked by Add-Type to compile inline RunPE P/Invoke declarations into a temporary .NET DLL
• %System%\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%User Temp%\{random}.tmp" "%User Temp%\{random}\{random}.res" → Resource converter child process of csc.exe (standard compiler pipeline artifact)
• %Windows%\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe → Process-hollowing target (launched suspended, memory replaced with RAT payload)

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

Propagation

This Trojan does not have any propagation routine.

Backdoor Routine

This Trojan does not have any backdoor routine.

Rootkit Capabilities

This Trojan does not have rootkit capabilities.

Information Theft

This Trojan does not have any information-stealing capability.

Other Details

This Trojan does the following:

• Relaunches itself with a hidden console window using ProcessStartInfo.WindowStyle = Hidden to avoid visible execution
• Uses the argument "ce5010f435" as a relaunch gate to distinguish first-run from payload execution

It does not exploit any vulnerability.