{
  "name": "StilachiRAT analysis: From system reconnaissance to cryptocurrency theft",
  "slug": "stilachirat-analysis-from-system-reconnaissance-to-cryptocurrency-theft",
  "description": "Microsoft Incident Response researchers discovered a novel remote access trojan named StilachiRAT, demonstrating sophisticated evasion, persistence, and data exfiltration techniques. The malware collects extensive system information, targets cryptocurrency wallet extensions, steals browser credentials, establishes command-and-control communication, executes remote commands, achieves persistence through Windows services, monitors RDP sessions, collects clipboard data, and employs anti-forensic measures. StilachiRAT's capabilities include system reconnaissance, digital wallet targeting, credential theft, command execution, and clipboard monitoring. The analysis reveals its potential for cryptocurrency theft and system manipulation.",
  "published": "2025-03-17T21:21:29+00:00",
  "created_at": "2025-03-17T21:21:29+00:00",
  "modified_at": "2025-03-18T08:58:35+00:00",
  "created_at_opencti": "2025-03-17T21:21:29+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-03-17",
    "anti-forensics",
    "command and control",
    "credential-theft",
    "cryptocurrency theft",
    "persistence",
    "rdp monitoring",
    "remote access trojan",
    "stilachirat",
    "system reconnaissance"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "app.95560.cc"
      },
      {
        "id": "",
        "name": "394743dd67eb018b02e069e915f64417bc1cd8b33e139b92240a8cf45ce10fcb"
      }
    ],
    "malware": [
      {
        "id": "0efc41dc-0127-4d52-9fb2-7cac4d364cdc",
        "name": "StilachiRAT",
        "slug": "stilachirat"
      }
    ],
    "vulnerabilities": [
      {
        "id": "",
        "name": "CVE-2023-36884"
      }
    ]
  },
  "external_refs": [
    "https://www.microsoft.com/en-us/security/blog/2025/03/17/stilachirat-analysis-from-system-reconnaissance-to-cryptocurrency-theft/",
    "https://otx.alienvault.com/pulse/67d8a06929a383efc5db4f71"
  ]
}