# Xeno-RAT

**URL:** <https://community.emergingthreats.net/t/xeno-rat/1290>\
**Category:** Rule Signatures\
**Created:** [January 17, 2024, 1:22pm UTC](https://community.emergingthreats.net/t/xeno-rat/1290 "2024-01-17T13:22:28Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jane0sint](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jane0sint/32/398_2.png) [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\
**Post date:** [January 17, 2024, 1:22pm UTC](https://community.emergingthreats.net/t/xeno-rat/1290/1 "2024-01-17T13:22:28Z")

</div>

Hi, I found traffic from XenoRAT and propose to detect it based on the content of the first 117 byte packet plus 21 bytes packet in stream.

> **[Analysis LoaderAsset.exe (MD5: 7DA5BD364FC0A60A43AB4797F5042B7E) No threats...](https://app.any.run/tasks/e6be415f-589d-4491-a1cd-abf070510d31/)**
>
> Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

```auto
alert tcp any any -> any any (msg: "ET MALWARE [ANY.RUN] Xeno-RAT TCP Check-In";flow: established, to_server;content: "|7100 0000 00|";depth:5;content: !"|00|"; within:1; content: "|1100 0000 00|";distance:112;within:5;content: !"|00|"; within:1; threshold: type limit, track by_dst, seconds 30, count 1;classtype: command-and-control;reference: md5,cb0a4f14d441666ccb5d0b2f170a2d78;reference: url,app.any.run/tasks/e6be415f-589d-4491-a1cd-abf070510d31;metadata: attack_target Client_Endpoint, deployment Perimeter, former_category MALWARE, signature_severity Major,malware_family Xeno-RAT, created_at 2024_01_17; sid: 1; rev: 1;)

```

Also another rule with a trash hold for 20 keep-alive packets in 30 seconds

```auto
alert pkt-tcp any any -> any any (msg: "ET MALWARE [ANY.RUN] Xeno-RAT TCP Keep-Alive";flow: established, to_server;dsize: 21; content: "|1100 0000 00|"; depth: 5;content: !"|00|"; within:1;threshold: type threshold, track by_dst, seconds 30, count 20;classtype: command-and-control;reference: md5, cb0a4f14d441666ccb5d0b2f170a2d78;reference: url,app.any.run/tasks/e6be415f-589d-4491-a1cd-abf070510d31;metadata: attack_target Client_Endpoint, deployment Perimeter, former_category MALWARE, signature_severity Major, malware_family Xeno-RAT, created_at 2024_01_17; sid: 2; rev: 1;)

```

> **[GitHub - moom825/xeno-rat: Xeno-RAT is an open-source remote access tool...](https://github.com/moom825/xeno-rat)**
>
> Xeno-RAT is an open-source remote access tool (RAT) developed in C#, providing a comprehensive set of features for remote system management. Has features such as HVNC, live microphone, reverse prox...

Best regards,  
⋆♱✮♱⋆ Jane ⋆♱✮♱⋆

---

<div class="post-metadata">

**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\
**Post date:** [January 17, 2024, 4:37pm UTC](https://community.emergingthreats.net/t/xeno-rat/1290/2 "2024-01-17T16:37:05Z")

</div>

Thanks @Jane0sint! We’ll get these in today’s release. I’ll let you know what the sids are when I have them. 🎉

---

<div class="post-metadata">

**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\
**Post date:** [January 17, 2024, 9:54pm UTC](https://community.emergingthreats.net/t/xeno-rat/1290/3 "2024-01-17T21:54:55Z")

</div>

@Jane0sint - Here are the sids for these

```auto
  2050110 - ET MALWARE [ANY.RUN] Xeno-RAT TCP Check-In
  2050111 - ET MALWARE [ANY.RUN] Xeno-RAT TCP Keep-Alive

```

---

<div class="post-metadata">

**Author:** ![rgonzalez](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@rgonzalez](https://community.emergingthreats.net/u/rgonzalez)\
**Post date:** [January 17, 2024, 10:03pm UTC](https://community.emergingthreats.net/t/xeno-rat/1290/4 "2024-01-17T22:03:59Z")

</div>

Thanks @ishaughnessy @Jane0sint !

---

<div class="post-metadata">

**Author:** ![Jane0sint](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jane0sint/32/398_2.png) [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\
**Post date:** [January 18, 2024, 7:12am UTC](https://community.emergingthreats.net/t/xeno-rat/1290/5 "2024-01-18T07:12:10Z")

</div>

I apologize for the error in the rule 2050110 due to the wrong choice of protocol, please change

> alert tcp-pkt → alert tcp

it. I’ll try to be more attentive, sorry ![Кланяющаяся женщина|20pxx20px](https://us1.discourse-cdn.com/flex016/uploads/emergingthreats/original/1X/4932d445cfb34587c1ec758dab166e96f6c44075.png)

---

<div class="post-metadata">

**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\
**Post date:** [January 18, 2024, 3:56pm UTC](https://community.emergingthreats.net/t/xeno-rat/1290/6 "2024-01-18T15:56:24Z")

</div>

no worries, this will be fixed in today’s release 👍

---

<div class="post-metadata">

**Author:** ![Jane0sint](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jane0sint/32/398_2.png) [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\
**Post date:** [March 11, 2024, 4:22pm UTC](https://community.emergingthreats.net/t/xeno-rat/1290/7 "2024-03-11T16:22:07Z")

</div>

Hi, I have an update to the rules due to the fact that I came across a sample with a slight modification. By the way, the developer himself tweeted me asking me to explain how detection works.

> **[Analysis CookieAdd.exe (MD5: 616CAE467E87BED467E0F7FF54C677A4) Malicious...](https://app.any.run/tasks/03287080-a592-4abd-925c-cd528ccd83cd/)**
>
> Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

```auto
alert tcp $EXTERNAL_NET any -> $HOME_NET any (
msg:"ET MALWARE [ANY.RUN] Xeno-RAT TCP Check-In Server Response";
flow:established,to_client; 
content:"|71 00 00 00 00|"; startswith; fast_pattern; 
content:!"|00|"; within:1; 
content:"|11 00 00 00|"; distance:112; within:5; 
content:!"|00|"; distance: 1; within:1;
threshold:type limit, track by_dst,seconds 30,count 1;
reference:md5,cb0a4f14d441666ccb5d0b2f170a2d78;
reference:url,app.any.run/tasks/e6be415f-589d-4491-a1cd-abf070510d31;
reference:url,github.com/moom825/xeno-rat;
reference:url,community.emergingthreats.net/t/xeno-rat/1290; 
classtype:command-and-control;
sid:2050110; rev:2; 
metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2024_01_17, deployment Perimeter, former_category MALWARE, malware_family XenoRat, confidence Medium, signature_severity Critical, updated_at 2024_01_18;)

```

```auto
alert tcp-pkt $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE [ANY.RUN] Xeno-RAT TCP Keep-Alive";
flow:established,to_server; 
dsize:21;
content:"|11 00 00 00|";depth: 4; fast_pattern;
content: !"|00|"; distance: 1; within:1;
byte_test: 1, <, 5, 0, relative; 
threshold:type threshold,track by_dst,seconds 30,count 20;
reference:md5,cb0a4f14d441666ccb5d0b2f170a2d78;
reference:url,app.any.run/tasks/e6be415f-589d-4491-a1cd-abf070510d31;
reference:url,github.com/moom825/xeno-rat;
reference:url,community.emergingthreats.net/t/xeno-rat/1290; 
classtype:command-and-control;
sid:2050111; rev:1;
metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2024_01_17, deployment Perimeter, former_category MALWARE, malware_family XenoRat, confidence Medium, signature_severity Critical, updated_at 2024_01_17;)

```

•̩̩͙_˚⁺‧͙⁺˚_•̩̩͙✩•̩̩͙\*˚⁺‧͙  
Jane

---

<div class="post-metadata">

**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\
**Post date:** [March 11, 2024, 4:37pm UTC](https://community.emergingthreats.net/t/xeno-rat/1290/8 "2024-03-11T16:37:25Z")

</div>

heya @Jane0sint !

I’ll get these updates out today!

> [@Jane0sint](#):
>
> the developer himself tweeted me asking me to explain how detection works.

This is hilarious ^ 🤣

Isaac

---

<div class="post-metadata">

**Author:** ![michaelfschem](https://avatars.discourse-cdn.com/v4/letter/m/a587f6/32.png) [@michaelfschem](https://community.emergingthreats.net/u/michaelfschem)\
**Post date:** [March 12, 2024, 5:58pm UTC](https://community.emergingthreats.net/t/xeno-rat/1290/9 "2024-03-12T17:58:00Z")

</div>

Getting multiple false positives with this signature when users are trying to connect to local development mysql servers.

---

<div class="post-metadata">

**Author:** ![Jane0sint](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jane0sint/32/398_2.png) [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\
**Post date:** [March 12, 2024, 6:32pm UTC](https://community.emergingthreats.net/t/xeno-rat/1290/10 "2024-03-12T18:32:47Z")

</div>

Please specify which of the two? Thank you! A little more detail wouldn’t hurt, is this port 3306? Accessing a local server from an external network?

---

<div class="post-metadata">

**Author:** ![michaelfschem](https://avatars.discourse-cdn.com/v4/letter/m/a587f6/32.png) [@michaelfschem](https://community.emergingthreats.net/u/michaelfschem)\
**Post date:** [March 12, 2024, 9:48pm UTC](https://community.emergingthreats.net/t/xeno-rat/1290/11 "2024-03-12T21:48:22Z")

</div>

Looks like sid 2050111. It’s not port 3306, our dev sql test servers spin up mysql instances for testing on random high ports. The traffic is internal to internal. Interestingly enough, the sig does not fire for our postgres instances on the same server.

---

<div class="post-metadata">

**Author:** ![Jane0sint](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jane0sint/32/398_2.png) [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\
**Post date:** [March 13, 2024, 5:01am UTC](https://community.emergingthreats.net/t/xeno-rat/1290/12 "2024-03-13T05:01:53Z")

</div>

> [@michaelfschem](#):
>
> 2050111

I think we can turn it off without losing coverage. Also non-standard is the fact that some of your internal addresses are in the $external\_net variable. Thank You again!

---

<div class="post-metadata">

**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\
**Post date:** [March 13, 2024, 4:25pm UTC](https://community.emergingthreats.net/t/xeno-rat/1290/13 "2024-03-13T16:25:15Z")

</div>

thanks @Jane0sint - I’ll disable in today’s release

thanks for the FP report @michaelfschem !