xenorat: c50bb7b4 — au88-branded v0.0.2.0 sibling with LZNT1 async C2

Executive Summary Second confirmed XenoRAT sibling in corpus. Open-source .NET Framework 4.8 RAT by moom825, builder-generated with au88 masquerade branding and fabricated 2104 timestamp. Same async node C2 architecture, LZNT1 compression, AES-MD5 encryption, and AssemblyResolve plugin loading as sibling 6133cd0b. No hardcoded C2 — builder-injected. Static-only (CAPE skipped, no Windows guest). Corrects the preliminary OpenCTI dcrat mislabel.

What It Is

• File: ed2252026.exe, 48 KB (47616 bytes) ^[file.txt]
• PE32 .NET Framework 4.8 GUI assembly, MS IL, 3 sections ^[file.txt]
• Linker v48.0, timestamp 2104-06-27 07:24:37 UTC (fabricated future date) ^[exiftool.json:15] ^[pefile.txt:34]
• Internal name: xeno rat client.exe ^[exiftool.json:40]
• Version info: Company=au88, Product=au88-manager, Version=0.0.2.0, OriginalFilename=au88.exe ^[exiftool.json:37-43]
• Unsigned, no Authenticode ^[rabin2-info.txt:27]
• No packer, no obfuscator — plain C# async/await IL ^[capa.txt:119]
• Author string moom825 present in .text ^[strings.txt:4]
• Namespace xeno_rat_client throughout metadata ^[strings.txt:387-486]
• Assembly GUID: $310fc5be-6f5e-479c-a246-6093a39296c0 ^[strings.txt:455]
• Preliminary OpenCTI label dcrat is a false positive; this is XenoRAT (see xenorat for family overview and sibling 6133cd0b).

How It Works Async/await state-machine architecture identical to sibling 6133cd0b. Heavy use of compiler-generated MoveNext/SetStateMachine methods for every async handler ^[strings.txt:8-90]. The binary is a builder-generated client stub with these modules:

• Node / subNode C2: Parent Node class manages TCP socket, child subNodes via AddSubNode ^[strings.txt:125-128]. Methods: ConnectSubSockAsync, ReceiveAsync, SendAsync, AuthenticateAsync ^[strings.txt:106-108].
• SocketHandler: Framing with ParseHeader, BytesToInt/IntToBytes, BTruncate, Concat ^[strings.txt:294,385-386,404-405]. Two receive variants: RecvAllAsync_ddos_unsafer and RecvAllAsync_ddos_safer ^[strings.txt:304-305].
• Compression: LZNT1 via RtlCompressBuffer / RtlDecompressBuffer P/Invoke with COMPRESSION_FORMAT_LZNT1 and COMPRESSION_ENGINE_MAXIMUM ^[strings.txt:24-95,205-312].
• Encryption: AES with MD5-derived key (capa hits decrypt data using AES via .NET and hash data with MD5) ^[capa.txt:82-83]. Encryption.Encrypt / .Decrypt methods confirmed by radare2 symbol table ^[r2:sym.method.xeno_rat_client.Encryption.Encrypt].
• Plugin loading: Reflective via AppDomain.CurrentDomain.AssemblyResolve callback in DllHandler.CurrentDomain_AssemblyResolve; plugin nodes DllNodeHandler traffic binary payloads over C2 socket ^[strings.txt:196-199,316]. See dotnet-assemblyresolve-plugin-loader.
• Persistence: Registry Run keys (AddToStartupAdmin, AddToStartupNonAdmin, RemoveStartup) ^[strings.txt:263-264,291] and scheduled tasks (schtasks references in capa) ^[capa.txt:116-117]. Maps to registry-run-persistence.
• Discovery: WMI AV enumeration (GetAntivirus), active window caption (GetCaptionOfActiveWindowAsync), idle time (GetIdleTimeAsync), machine/user name, OS version, processor count ^[strings.txt:148-151,288-290,398]. Capa confirms WMI, process discovery, registry query, system info ^[capa.txt:24-29].
• Console capture: CapturingConsoleWriter with GetCapturedOutput / ClearCapturedOutput for exfil of stdout/stderr ^[strings.txt:324,412-414].
• Anti-analysis: Minimal. Capa flags reference anti-VM strings targeting Xen ^[capa.txt:75]. No debugger checks, no sandbox gates, no string encryption.

Decompiled Behavior Ghidra analysis queued but incomplete at time of writing (CIL backend still processing). radare2's pdc decompiler for .NET produces minimal pseudo-C due to stack-machine IL abstraction; function bodies resolve to nop/break/return stubs ^[r2:0x00402984]. Full behavior is recoverable from IL metadata tokens and capa static rules. For IL-level inspection, dnSpy or ILSpy on ed2252026.exe would show the actual AES/LZNT1/socket logic.

C2 Infrastructure No hardcoded IP, domain, or port in static strings. C2 address is builder-injected at runtime into ServerIp / ServerPort fields ^[strings.txt:287,403]. Sub-server infrastructure via subServer ^[strings.txt:327]. Heartbeat mechanism: HearbeatReply / HearbeatFail ^[strings.txt:46,54].

Interesting Tidbits

• au88 branding is unique to this sibling; 6133cd0b had different/missing version-info masquerade.
• Fabricated 2104 timestamp is 78 years in the future — crude anti-forensics.
• floss.txt is empty due to CLI argument error (--no flag misparsed); no decoded strings layer available for this sample.
• binwalk.txt flags LZMA at offset 0xB801 — false positive from .NET metadata layout, not a real embedded payload.
• DDoS receive variants (ddos_safer / ddos_unsafer) suggest builder includes optional network-stress modules.

How To Mess With It (Homelab Replication)

• Toolchain: Visual Studio 2022, .NET Framework 4.8 console app
• Compile a minimal async TCP client with TcpClient, NetworkStream, async/await
• Add LZNT1 compression via P/Invoke to ntdll.dll!RtlCompressBuffer
• Add AES-256-CBC with MD5-derived key
• Wire up AppDomain.CurrentDomain.AssemblyResolve to load a dummy plugin from byte[]
• Run capa <reproducer.exe> and compare to this sample's capa.txt — expect hits on create TCP socket, compress data via WinAPI, decrypt data using AES via .NET, load .NET assembly

Deployable Signatures

YARA rule

rule XenoRAT_AU88_Sibling {
    meta:
        description = "XenoRAT au88-branded sibling v0.0.2.0"
        author = "PacketPursuit SOC"
        date = "2026-06-14"
        sha256 = "c50bb7b421d88aebc578a5f2c9004771ccfeae6424403fb0e1a582a39d74e71e"
    strings:
        $s1 = "xeno rat client.exe" wide ascii
        $s2 = "xeno_rat_client" wide ascii
        $s3 = "moom825" wide ascii
        $s4 = "au88" wide ascii
        $s5 = "au88-manager" wide ascii
        $s6 = "COMPRESSION_FORMAT_LZNT1" wide ascii
        $s7 = "RecvAllAsync_ddos_unsafer" wide ascii
        $s8 = "HearbeatReply" wide ascii
        $s9 = "CapturingConsoleWriter" wide ascii
        $s10 = "CurrentDomain_AssemblyResolve" wide ascii
    condition:
        uint16(0) == 0x5A4D and
        filesize < 100KB and
        6 of them
}

Behavioral hunt query (KQL / Microsoft Defender for Endpoint)

DeviceProcessEvents
| where FileName contains "ed2252026.exe" or FileName contains "au88.exe" or FileName contains "xeno rat client.exe"
| union (
    DeviceNetworkEvents
    | where InitiatingProcessCommandLine contains "xeno_rat_client"
)
| union (
    DeviceRegistryEvents
    | where RegistryKey contains @"Software\Microsoft\Windows\CurrentVersion\Run"
    and InitiatingProcessCommandLine contains "ed2252026.exe"
)

IOC list | Indicator | Value | Type | | ed2252026.exe | filename | | | xeno rat client.exe | internal name | | | au88.exe | original filename | | | au88 | company name | | | au88-manager | product name | | | 0.0.2.0 | version | | | c50bb7b421d88aebc578a5f2c9004771ccfeae6424403fb0e1a582a39d74e71e | sha256 | | | moom825 | author string | | | $310fc5be-6f5e-479c-a246-6093a39296c0 | assembly GUID | |

Behavioral fingerprint A .NET Framework 4.8 GUI executable (<=50 KB) launches with mscoree.dll IAT only, immediately creates a TCP socket, and enters an async MoveNext state-machine loop. Within 30 seconds it queries WMI for antivirus products, reads the active window caption via GetForegroundWindow/GetWindowText, and writes to HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Network traffic is framed with a 4-byte length prefix and encrypted with AES-256-CBC using an MD5-derived key, optionally compressed with LZNT1. Plugin DLLs are loaded reflectively via Assembly.Load(byte[]) with no disk write.

Detection Signatures capa ATT&CK mapping for this sample ^[capa.txt:14-34]:

• T1547.001 — Registry Run Keys / Startup Folder
• T1053.005 — Scheduled Task
• T1047 — WMI
• T1620 — Reflective Code Loading
• T1497.001 — VM Detection (Xen string ref)
• T1140 — Deobfuscate/Decode Files or Information
• T1112 — Modify Registry
• T1027 — Obfuscated Files or Information
• T1560.002 — Archive Collected Data via Library
• T1213 — Data from Information Repositories
• T1087 — Account Discovery
• T1083 — File and Directory Discovery
• T1057 — Process Discovery
• T1012 — Query Registry
• T1082 — System Information Discovery
• T1033 — System Owner/User Discovery

References

• Family entity: xenorat
• Technique: dotnet-assemblyresolve-plugin-loader
• Procedure: registry-run-persistence
• Sibling analysis: 6133cd0b ^[/intel/analyses/6133cd0b2a8a7a1ecf353ae072c1e64934bfbeb0693cb7dc59d6d55173d6e0a7.html]
• Artifact ID: f4478830-e15b-42a4-90c9-aa5ac51a1f18
• Source: OpenCTI / MalwareBazaar (mislabeled dcrat)

Provenance Static inputs: file.txt, exiftool.json, pefile.txt, strings.txt, capa.txt, binwalk.txt, rabin2-info.txt, triage.json, metadata.json. Tools: file v5.45, exiftool v12.76, pefile, strings, capa v7, binwalk v2.3.4, rabin2 v5.9.8, radare2 (cil analysis). No CAPE detonation (no Windows guest). No floss decoded strings (CLI error). Ghidra analysis incomplete at report time.