KarstoRAT analysis: Discord token theft, fodhelper UAC bypass, and on-command self-destruct

Conclusion

• Establishes HTTP‑based command‑and‑control (C2) with configurable server and port.

• Provides interactive remote shell, file upload/download, keylogging, screen and webcam capture, audio recording, clipboard monitoring, and system information collection.

• Steals tokens/credentials by scanning Discord and major browsers’ LevelDB storage and uploads them to the C2.

• Persists via a scheduled task (“SystemCheck”) and registry Run entries, and includes a UAC bypass via the fodhelper.exe technique to elevate itself.

• Implements a self‑destruct routine that removes persistence, deletes its binaries, runs a hidden cleanup batch script, and exits.

Scope and Coverage

• Artifact analyzed: win_rat.exe (PE32+ executable for Windows, x86‑64, 6 sections, size 151,552 bytes; SHA‑256 07131e3fcb9e65c1e4d2e756efdb9f263fd90080d3ff83fbcca1f31a4890ebdb).

• Platform: Windows x86‑64 (platform: windows-x86_64).

• Techniques used:
• Static file characterization and entropy: shows typical code/data entropy (~6.25 bits/byte), no obvious packing.
• Disassembly/decompilation via bintools for selected functions.
• String extraction and cross‑reference analysis to map behaviors.

• Not performed:
• No dynamic execution/emulation; behavior is inferred from code and strings.
• No outbound C2 connections were attempted (no runtime network observation).

Artifact Relationships and Behavioral Sequence

1. Initialization and external IP discovery
• Function sub_1400016f0 (0x1400016f0) calls WinINet APIs:
• InternetOpenA("SecurityNotifier", 1, nullptr, nullptr, 0)
• InternetOpenUrlA(..., "http://api.ipify.org", ...)
• InternetReadFile into a 0x40‑byte buffer, null‑terminates it, and copies into an internal string buffer.
• Evidence:
• String "SecurityNotifier" at 0x14001cef0.
• String "http://api.ipify.org" at 0x14001cf08.
• Purpose: obtain the victim’s public IP address, presumably to register the client with the C2.

2. C2 session establishment and HTTP request building
• Function sub_140001b50 (0x140001b50) handles generic HTTP POST requests:
• Opens C2 session: InternetOpenA("SecurityNotifier", 1, ...).
• Connects to the configured server/port:
• Host string from global buffer data_140025250.
• Port from data_140025ee8.
• Uses InternetConnectA(hInternet, lpszServerName, data_140025ee8, ..., 3, ...).
• Builds a URI suffix incorporating a ?user= query parameter:
• String "?user=" at 0x14001cf48.
• Method "POST" at 0x14001cf50.
• Uses HttpOpenRequestA( ..., "POST", lpszObjectName, ...) and HttpSendRequestA with supplied body (arg3/arg4).
• This function appears to be the generic request sender used by specific actions to post data to endpoints.

3. Action routing and commands
• Numerous action/status strings and endpoint paths indicate an action‑based protocol, e.g.:
• Endpoints (strings table):
• /notify?event=log&user=
• /notify?event=heartbeat&user=
• /client-download?user=
• /client-upload?user=
• /upload-keylog
• /upload-screen
• /upload-sysinfo
• /upload-webcam
• /upload-audio
• /upload-clipboard
• /upload-tokens
• /upload-shell-output
• /get-shell-input
• Action labels and statuses:
• Action: [DOWNLOAD] -> Success (Saved to
• Action: [UPLOAD] -> Failed (File not found)
• Action: [UPLOAD] -> Success (Uploaded
• Action: [SYSINFO] -> Success
• Action: [SHELL_START] -> Failed
• Action: [SHELL_START] -> Success
• Action: [SHELL_STOP] -> Success
• Action: [WEBCAM] -> Failed (No capture window) / (No webcam found) / Success
• Action: [WALLPAPER] -> Success / Failed
• Action: [AUDIO] -> recorded
• Action: [TOKEN_GRAB] -> Failed (Path Error) / No tokens found / Found
• Action: [SELF_DESTRUCT] -> Initiating... / Complete. Goodbye.
• Command identifiers:
• SHELL_START, SHELL_STOP, SHELL_INPUT:
• SCREENSHOT
• KEYLOG_ON, KEYLOG_OFF
• WEBCAM
• AUDIO_RECORD:
• CLIPBOARD_ON, CLIPBOARD_OFF
• TOKEN_GRAB
• SELF_DESTRUCT
• STARTUP_ON, STARTUP_OFF
• These strings map onto specific code paths (e.g., TOKEN_GRAB and SHELL_START both reference dispatcher function at 0x140008a10), indicating a central command handler that receives server commands and dispatches to capability‑specific routines.

Key Findings

1. Network C2 over HTTP

• WinINet usage
• sub_1400016f0 and sub_140001b50 use the following APIs (resolved by the analyzer):
• InternetOpenA, InternetOpenUrlA, InternetReadFile, InternetCloseHandle.
• InternetConnectA, HttpOpenRequestA, HttpSendRequestA.
• User‑agent / application name string: "SecurityNotifier" (0x14001cef0).

• C2 endpoints and parameters
• Hard‑coded path segments in strings table:
• /notify?event=log&user=
• /notify?event=heartbeat&user=
• /client-download?user=
• /client-upload?user=
• /upload-* paths for keylog, screen, sysinfo, webcam, audio, clipboard, tokens.
• Query parameter template "?user=" and HTTP method "POST" in sub_140001b50.

• External IP discovery
• http://api.ipify.org is used to resolve public IP before contacting C2.

• The binary maintains HTTP‑based C2 to a configurable hostname/port (in global variables, not plainly visible in ASCII), using WinINet rather than raw sockets.

• It is designed to maintain a heartbeat (/notify?event=heartbeat&user=) and push logs/events back to the server, as well as upload various data types.

• Completely consistent with a RAT or backdoor, not a single‑purpose tool.

2. Remote Shell Execution

• Strings (with xrefs into the command dispatcher at ~0x140008a10):
• SHELL_START, SHELL_STOP, SHELL_INPUT:.
• /get-shell-input, /upload-shell-output.
• Status strings: Action: [SHELL_START] -> Failed, Action: [SHELL_START] -> Success, Failed (Shell Error).
• Executable name: "cmd.exe".

• Network endpoints imply polling for commands and uploading command output.

• The RAT supports an interactive command shell over HTTP, likely by:
• Starting cmd.exe on the victim (via CreateProcess or ShellExecute, not explicitly shown in the snippets but implied by cmd.exe and shell status messages).
• Polling /get-shell-input for commands and posting output to /upload-shell-output.

• This is a classic remote shell backdoor capability.

3. Persistence via Scheduled Task and Registry Run Key

• Self‑destruct routine sub_140008410 (0x140008410) reveals how persistence is set up:
• Opens HKCU Run key:
• RegOpenKeyExA(HKCU, "Software\Microsoft\Windows\CurrentVersion\Run", ..., &var_4a8).
• Deletes value "SecurityService" via RegDeleteValueA and closes the key.
• Deletes scheduled task named "SystemCheck":
• system("schtasks /delete /f /tn "SystemCheck" >nul 2>&1") (string at 0x14001d7e0).
• Deletes an installed copy of the malware:
• Constructs a path %APPDATA%\SecurityService.exe using SHGetFolderPathA and helper string‑building functions, then calls DeleteFileA.
• Creates a hidden cleanup batch file in %TEMP%:
• Uses GetTempPathA and builds cleanup.bat path.
• Writes commands like:
• @echo off\n
• ping 127.0.0.1 -n 3 >nul\n (delay)
• del /f /q "<current_executable>"
• del /f /q "%~f0"\n (delete the script itself).
• Executes it via ShellExecuteA(..., "open", <cleanup.bat>, ..., SW_HIDE).
• Logs status:
• "Action: [SELF_DESTRUCT] -> Initiating..." and "Action: [SELF_DESTRUCT] -> Complete. Goodbye.".

• Startup strings:
• "STARTUP_ON", "Success (Added to Startup)", "STARTUP_OFF", "Success (Removed from Startup)".
• Command strings:
• "schtasks /create /f /sc onlogon /tn "SystemCheck" /tr "" (0x14001d8b0 region).
• "schtasks /delete /f /tn "SystemCheck"".

• The malware uses at least two persistence mechanisms:
• Registry Run key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run with value name SecurityService pointing to its executable.
• Scheduled task named SystemCheck created with schtasks /create /sc onlogon /tn "SystemCheck" /tr "...SecurityService.exe" to run on user logon.

• The self‑destruct function explicitly cleans up both persistence artifacts and its files, demonstrating deliberate stealth and lifecycle control.

4. UAC Bypass via Fodhelper Trick

• Function sub_140008670 (0x140008670):
• Gets its own path: GetModuleFileNameA(nullptr, &filename, 0x104).
• Creates/opens a registry key under HKCU:
• RegCreateKeyExA(HKCU, "Software\Classes\ms-settings\Shell\Open\command", ...).
• Writes the default key value to point to the malware path:
• RegSetValueExA( <key>, nullptr, 0, REG_SZ, &filename, len+1 ).
• Sets DelegateExecute value:
• RegSetValueExA( <key>, "DelegateExecute", 0, REG_SZ, &data_14001cea1, 1) (effectively an empty CLSID string).
• Closes key and launches fodhelper.exe hidden via ShellExecuteA:
• ShellExecuteA(nullptr, "open", "C:\Windows\System32\fodhelper.exe", nullptr, 0, SW_HIDE).
• Sleeps 3 seconds: Sleep(0xbb8).
• Deletes Software\Classes\ms-settings with RegDeleteTreeA.
• Logs success/failure:
• "Action: [UAC_BYPASS] -> Success (Elevated instance launched)".
• "Action: [UAC_BYPASS] -> Failed (RegCreate Error)".

• This is the well‑known fodhelper UAC bypass technique:
• It exploits the auto‑elevated fodhelper.exe reading HKCU ms-settings class settings to execute arbitrary command as administrator without a standard UAC prompt.

• It demonstrates deliberate privilege escalation and evasion behavior.

5. Keylogging and Keyboard Monitoring

• Strings:
• Command labels: "KEYLOG_ON", "KEYLOG_OFF".
• Status: "Success (Keylogger Started)", "Success (Keylogger Stopped)".
• Upload endpoint: /upload-keylog.

• API names (as strings, likely used via LoadLibrary/GetProcAddress):
• "SetWindowsHookExA" at address ~0x140021c44.
• "USER32.dll".

• These strings are referenced within the same command‑handling region as other actions.

• The RAT includes a keylogger which can be turned on and off by the server.

• It likely uses a low‑level keyboard hook (SetWindowsHookExA) in USER32.dll to capture keystrokes, buffers them, and periodically uploads logs to /upload-keylog.

6. Clipboard Monitoring and Exfiltration

• Strings:
• Commands: "CLIPBOARD_ON", "CLIPBOARD_OFF".
• Status: "Success (Clipboard Monitor Started)", "Success (Clipboard Monitor Stopped)".
• Upload endpoint: /upload-clipboard.

• Clipboard API names present as strings:
• "OpenClipboard", "GetClipboardData", "CloseClipboard".

• The malware can monitor the system clipboard and exfiltrate clipboard content to the C2.

• This facilitates theft of passwords, tokens, or other sensitive copied data.

7. Screen Capture and Webcam Capture

• Screen capture:
• Endpoint: /upload-screen.
• Command: "SCREENSHOT".
• Status: "Success (Screen Captured)".

• Webcam capture:
• Command: "WEBCAM".
• Endpoints and status:
• /upload-webcam.
• "Action: [WEBCAM] -> Failed (No capture window)".
• "Action: [WEBCAM] -> Failed (No webcam found)".
• "Action: [WEBCAM] -> Success".
• Capture API strings:
• "capCreateCaptureWindowA".
• "AVICAP32.dll".

• The RAT can take screenshots and stream/capture from the webcam, uploading images to the server.

• Use of AVICAP32.dll and capCreateCaptureWindowA is a standard pattern for webcam capture.

8. Audio Recording

• Strings:
• "open new type waveaudio alias recsound".
• Command/label: "AUDIO_RECORD:".
• Endpoint: /upload-audio.
• Status: "Action: [AUDIO] -> recorded ".

• API string: "mciSendStringA".

• The malware can record microphone audio using MCI (Multimedia Command Interface) commands (mciSendStringA) and upload recorded audio to the server.

9. Token/Credential Theft (Discord and Browsers)

• Command and logs:
• "TOKEN_GRAB".
• Endpoints: /upload-tokens.
• Status strings:
• "Action: [TOKEN_GRAB] -> Failed (Path Error)".
• "Action: [TOKEN_GRAB] -> No tokens found".
• "Action: [TOKEN_GRAB] -> Found ".
• " tokens".

• Target paths (strings clearly enumerating leveldb paths):
• "\discord\Local Storage\leveldb\".
• "\discordcanary\Local Storage\leveldb\".
• "\discordptb\Local Storage\leveldb\".
• "\Google\Chrome\User Data\Default\Local Storage\leveldb\".
• "\BraveSoftware\Brave-Browser\User Data\Default\Local Storage\leveldb\".
• "\Opera Software\Opera Stable\Local Storage\leveldb\".

• The malware explicitly targets Discord and major Chromium‑based browsers’ Local Storage LevelDB directories.

• This is characteristic of Discord token stealers and general session/token theft: tokens for Discord and potentially other web services can be extracted from these databases and sent to /upload-tokens.

• This is direct credential/session theft and strongly malicious.

10. System Information and Miscellaneous Control

• System info:
• Endpoint /upload-sysinfo and status string "Action: [SYSINFO] -> Success" indicate host profiling.

• Wallpaper/screen manipulation:
• "Action: [WALLPAPER] -> Success", "Action: [WALLPAPER] -> Failed".
• "Success (Screen Rotated 180)", "Success (Screen Restored)".

• Self‑destruct: function sub_140008410 described above.

• The malware collects general system information and implements cosmetic or disruptive display changes (screen rotation, wallpaper change) under remote control.

• The self‑destruct routine allows the operator to remove the tool from a host and erase traces.

Alternative Explanations and Contrary Evidence

• Against this explanation:
• Use of a UAC bypass (fodhelper) is unnecessary and inappropriate for legitimate tools.
• Explicit token grabbing from Discord and browser LevelDB stores is theft‑oriented and not part of normal administration.
• Self‑destruct behavior that deletes its own executable, persistence entries, and runs a hidden cleanup batch is consistent with concealment rather than legitimate uninstallation.
• Use of generic service/task names like SecurityService and SystemCheck for persistence is a common masquerading technique.

Unknowns and Limitations

• Exact C2 address and protocol details:
• The hostname and port are stored in globals (data_140025250, data_140025ee8) that were not decoded from plain strings; they may be obfuscated or configured at runtime.
• We did not execute the binary to observe real network connections or traffic format.

• Full command set:
• While many commands are evident from strings, we did not exhaustively reverse every handler, so minor actions may be unlisted.

• Encryption/obfuscation of payloads:
• The snippets show raw HTTP POSTs; we did not analyze in depth whether request bodies are encrypted or encoded.

• Triggering conditions:
• Without dynamic analysis, we cannot confirm any time‑based, environment‑based, or operator‑driven triggers.

Verdict Rationale

• The sample is an unpacked, fully implemented remote access trojan and stealer with:
• Persistent, configurable C2 over HTTP.
• Rich remote control capabilities (shell, file operations, screen/webcam/audio/clipboard capture, system info).
• Explicit credential/session theft from targeted applications (Discord and major browsers).
• Multiple persistence mechanisms and a UAC bypass to maintain/increase access.
• Self‑destruct features aimed at hiding its presence and removing traces.

• These behaviors are backed by concrete code and strings at specific addresses and are not incidental capabilities.

• The presence of dedicated stealing and evasion techniques rules out legitimate administrative use.