Sainbox RAT (Trojan) – Malware

Overview

In the evolving landscape of cybersecurity threats, the Sainbox Remote Access Trojan (RAT) has emerged as a notable variant of the Gh0stRAT malware family. First identified by Proofpoint in 2020, Sainbox RAT, also known as FatalRAT, represents a sophisticated evolution of the Gh0stRAT trojan, which has been a fixture in the malware ecosystem since its inception in 2008. The resurgence of Sainbox RAT in recent months highlights the ongoing relevance of older malware families and their adaptation to contemporary threat environments.

Sainbox RAT is characterized by its ability to remotely control infected systems, facilitating a range of malicious activities such as data exfiltration, system surveillance, and unauthorized access. This malware variant has been predominantly observed in targeted campaigns utilizing Chinese-language lures and communications, reflecting its focus on Chinese-speaking environments and organizations with operations in China. Its delivery methods often involve deceptive email attachments or links, masquerading as legitimate business documents or invoices, which upon execution deploy the RAT onto the victim’s system.

Targets

This malware targets individual windows users in China

How they operate

Upon initial infection, Sainbox RAT typically leverages phishing techniques to gain entry into target systems. Attackers often deploy Sainbox through emails containing malicious attachments or links disguised as legitimate business documents, such as invoices. These emails are usually written in Chinese, reflecting the malware’s primary targeting of Chinese-speaking environments. The attachments are often compressed files, such as ZIP archives, that, when executed, deploy the RAT. This method of delivery capitalizes on social engineering to entice users into executing the payload, thereby facilitating the malware’s entry into the victim’s system.

Once executed, Sainbox RAT initiates a series of checks to confirm its environment and ensure it operates within a legitimate system context. It begins by examining system characteristics such as the presence of VMware virtual machine processes and system memory and storage sizes. These checks help the RAT to evade detection by identifying and avoiding virtualized environments often used by analysts for malware analysis. If these checks are passed, the RAT proceeds with its main functionalities.

Sainbox RAT communicates with its command-and-control (C2) server using HTTP protocols. The malware is equipped with a set of commands that enable extensive remote control capabilities. These commands include actions such as executing files, capturing system process lists, and setting the RAT to persist across system reboots. The communication between the RAT and C2 server is encrypted and obfuscated to avoid detection and interception. The RAT can also exfiltrate data from the infected machine back to the attacker’s server, making it a potent tool for data theft.

In terms of persistence, Sainbox RAT employs several techniques to maintain its foothold on the victim’s system. It often modifies system registry entries or places itself in startup folders to ensure it is executed every time the system boots. This persistence mechanism allows the malware to remain active even after reboots, providing continuous access to the attackers.

MITRE Tactics and Techniques

Initial Access (TA0001)

Phishing (T1566): Sainbox RAT often uses phishing emails with malicious attachments or links, such as fake invoices, to lure victims into executing the malware.

Execution (TA0002)

Malicious File (T1203): The RAT is typically delivered via compressed executable files or attachments (e.g., ZIP files) that, when opened, execute the malware on the victim’s machine.

User Execution (T1203): The malware relies on users executing malicious files or documents to install and activate itself.

Persistence (TA0003)

Registry Run Keys / Startup Folder (T1547): Sainbox RAT may modify registry keys or add entries to startup folders to ensure it runs automatically when the system starts.

Privilege Escalation (TA0004)

Valid Accounts (T1078): The malware may use compromised credentials to escalate privileges or maintain access.

Command and Control (TA0011)

Command and Control over HTTP (T1071.001): Sainbox RAT communicates with its command-and-control (C2) server over HTTP, allowing remote control and data exfiltration.

Data Staged (T1074): It may stage data collected from the victim system before sending it to the C2 server.

Exfiltration (TA0010)

Exfiltration Over Command and Control Channel (T1041): The malware exfiltrates stolen data to the C2 server over the same channel used for command and control.

Impact (TA0040)

Data Destruction (T1485): While not its primary function, Sainbox RAT can potentially be used to delete or destroy data as part of its impact on the victim’s system.

References

• FatalRat
• Chinese Malware Appears in Earnest Across Cybercrime Threat Landscape