Microsoft has identified a sophisticated new remote access trojan (RAT) called StilachiRAT, designed to evade detection while stealing sensitive information from compromised systems. Discovered in November 2024, this advanced malware demonstrates significant capabilities for data theft and system manipulation.

## Key Capabilities

StilachiRAT, contained within a DLL module named “WWStartupCtrl64.dll,” collects extensive system information including:
– Operating system details
– Hardware identifiers and BIOS serial numbers
– Camera presence
– Active RDP sessions
– Running GUI applications

The malware specifically targets cryptocurrency wallets in Google Chrome, including popular extensions like MetaMask, Trust Wallet, Coinbase Wallet, and Phantom. It also extracts stored Chrome credentials, monitors clipboard content, and captures information from active windows.

## Advanced Evasion Techniques

StilachiRAT employs sophisticated anti-forensic methods to avoid detection:
– Clearing event logs
– Checking for analysis tools
– Detecting sandbox environments
– Implementing timer checks to prevent activation in virtual environments

## Command Capabilities

The malware maintains two-way communication with command-and-control servers, supporting ten different commands including:
– Displaying dialog boxes with content from specified URLs
– Clearing event logs
– Enabling system shutdown through undocumented Windows APIs
– Managing network connections
– Launching applications
– Putting systems into sleep or hibernation states

## Additional Threats

Palo Alto Networks Unit 42 has also identified other unusual malware samples, including an IIS backdoor, a bootkit using an unsecured kernel driver, and a cross-platform post-exploitation framework called ProjectGeass.

While the distribution method for StilachiRAT remains unclear, organizations are advised to implement robust security measures to protect against such sophisticated threats.