Full Report
SilabRAT (aka SnappyClient) is an advanced Remote Access Trojan (RAT) sold as a Malware-as-a-Service (MaaS) on Darkweb forums. Developed by the threat actor "o1oo1," SilabRAT is heavily focused on financial gain through credential theft. It offers stability and is capable of bypassing existing security measures.
Analysis Summary
# Tool/Technique: SilabRAT (aka SnappyClient)
## Overview
SilabRAT is an advanced Remote Access Trojan (RAT) marketed as a Malware-as-a-Service (MaaS) on Darkweb forums. Developed by the threat actor "o1oo1," its primary design objective is financial gain through the systematic theft of credentials and sensitive browser data. It is noted for its stability, modular nature, and ability to bypass standard security controls.
## Technical Details
- **Type:** Malware Family (Remote Access Trojan)
- **Platform:** Windows
- **Capabilities:** Credential theft, remote command execution, screen capturing, and session hijacking.
- **First Seen:** Approximately late 2023 / early 2024 (based on emergence of "o1oo1" campaigns).
## MITRE ATT&CK Mapping
- **TA0002 - Execution**
- T1059 - Command and Scripting Interpreter
- T1204 - User Execution
- **TA0003 - Persistence**
- T1547.001 - Registry Run Keys / Startup Folder
- **TA0005 - Defense Evasion**
- T1112 - Modify Registry
- T1027 - Obfuscated Files or Information
- **TA0007 - Discovery**
- T1087 - Account Discovery
- T1217 - Browser Information Discovery
- T1083 - File and Directory Discovery
- T1057 - Process Discovery
- T1518 - Software Discovery
- T1082 - System Information Discovery
- **TA0008 - Lateral Movement**
- T1021 - Remote Services
- **TA0009 - Collection**
- T1560 - Archive Collected Data
- T1185 - Browser Session Hijacking
- T1115 - Clipboard Data
- T1114 - Email Collection
- T1113 - Screen Capture
- **TA0011 - Command and Control**
- T1071 - Application Layer Protocol
- T1001 - Data Obfuscation
- T1571 - Non-Standard Port
- **TA0010 - Exfiltration**
- T1041 - Exfiltration Over C2 Channel
- **TA0040 - Impact**
- T1657 - Financial Theft
## Functionality
### Core Capabilities
- **Information Stealing:** Targeted extraction of saved passwords, cookies, and autofill data from popular web browsers.
- **Remote Shell:** Provides the attacker with a command-line interface to execute arbitrary system commands.
- **File Management:** Ability to upload, download, delete, and execute files on the infected host.
- **System Monitoring:** Capabilities to capture screenshots and monitor clipboard activities.
### Advanced Features
- **Session Hijacking:** Stealing active session tokens to bypass Multi-Factor Authentication (MFA).
- **Security Bypass:** Implements techniques to evade detection by standard antivirus (AV) and Endpoint Detection and Response (EDR) solutions.
- **MaaS Model:** Distributed with a user-friendly panel for buyers, allowing for easy configuration of payloads and C2 management.
## Indicators of Compromise
### File Hashes (SHA256)
- `fbce30a0c852972fdc24f1b6a7c270512a50ef1a7c6c88c88b92a2dcbdfdd023` (SilabRAT Loader/Main)
- `3a6adbe0081b2488e0f137496e92591e0c29148154b2d99faadab9cc435b879b` (APPBDLL.dll - 64bit)
- `fb56e66920c84ef9e51db0ea23144f5755daef97cbff8613b05ab56d0dc9d623` (APPBDLL.dll - 32bit)
- `79f8da9f9fb4ac7c16d9c210f1f6ef418357a3e7bf602b1dd03a490596fa58c5` (Target.dll)
### File Names
- `SilabRAT.exe`
- `APPBDLL.dll`
- `Target.dll`
### Network Indicators
- `91.199.163[.]124` (C2 Server)
### Behavioral Indicators
- Unexpected modification of browser profile directories.
- Modification of `Software\Microsoft\Windows\CurrentVersion\Run` for persistence.
- Rapid enumeration of system information and installed software immediately after execution.
## Associated Threat Actors
- **o1oo1** (Developer/Seller)
## Detection Methods
- **Signature-based detection:** Utilize the provided SHA256 hashes in EDR/AV blocklists.
- **Behavioral detection:** Monitor for unauthorized processes attempting to read browser "Login Data" files or "Cookies" databases. Watch for non-standard ports used for outbound connections by unusual processes.
- **YARA:** Organizations should develop rules targeting the specific strings and exports found in `APPBDLL.dll` and `Target.dll`.
## Mitigation Strategies
- **Prevention:** Implement strict Application Control to prevent unauthorized executables from running in user directories (e.g., `%AppData%`).
- **Hardening:** Disable or restrict the use of PowerShell and CMD for standard users. Use browser security features that encrypt local credential stores with hardware-backed keys where available.
- **Identity:** Enforce Phishing-resistant MFA (such as FIDO2/WebAuthn) to mitigate the impact of stolen session cookies.
## Related Tools/Techniques
- **RedLine Stealer:** Similar focus on credential and session theft.
- **Agent Tesla:** Similar data exfiltration and monitoring capabilities.
- **Vidar Stealer:** A competing MaaS often used for initial access and financial theft.