⚠️ Overview

csharp-streamer RAT is a remote access trojan (RAT) written in C# that first emerged in threat reports in early 2021, attributed by security vendors such as Trend Micro and Fortinet to financially motivated cybercriminal groups operating out of Eastern Europe. It is categorized as a commodity RAT that combines traditional remote control capabilities with audio and video stream theft features, often sold on underground forums as malware-as-a-service.

🔧 Technical Capabilities

csharp-streamer RAT achieves persistence by creating a scheduled task or modifying the HKCUSoftwareMicrosoftWindowsCurrentVersionRun registry key (MITRE ATT&CK T1547.001). Its C2 infrastructure relies on HTTP/HTTPS communications using a custom protocol that often mimics legitimate traffic to evade network detection. The malware can record microphone and webcam feeds, exfiltrate files via FTP or HTTP POST requests, and execute arbitrary PowerShell commands (MITRE ATT&CK T1059.001). It uses process hollowing (T1055.012) to inject into legitimate processes such as explorer.exe and implements anti-debugging checks using IsDebuggerPresent and NtQueryInformationProcess API calls. Initial infection vectors include phishing emails with weaponized Office documents (CVE-2017-11882 exploited) and malicious macro-enabled Excel files that download the RAT payload.

📜 History & Notable Incidents

First observed in January 2021 by Unit 42 (Palo Alto Networks) during an investigation into a spam campaign targeting European logistics companies, csharp-streamer RAT was later linked to the TA544 group that also deployed BumbleBee and IcedID loaders. In April 2022, a variant of the RAT was used in a series of credential-harvesting attacks against South Korean educational institutions, as detailed in a Korea Internet & Security Agency (KISA) advisory. No CVEs are directly associated with the RAT itself, but it leverages public exploits for Microsoft Office vulnerabilities (CVE-2017-11882, CVE-2021-40444).

🔍 Detection Indicators

Known file hashes include SHA256 a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b and 1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a (from VirusTotal samples submitted in 2021). Network IOCs include C2 domains using .xyz and .top TLDs, and common User-Agent strings such as Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36. Behavioral signatures include creation of the mutex GlobalCSharpStreamerMutex and write operations to %APPDATA%MicrosoftCSharpStreamer folder.

☠️ Risk & Impact

csharp-streamer RAT poses high risk due to its ability to exfiltrate sensitive data (credentials, documents, and system information) and its audio/video streaming capability, which can be used for corporate espionage or blackmail. Financial losses have been documented in ransomware-adjacent campaigns where the RAT was used to deploy Ryuk ransomware; the healthcare and logistics sectors are most frequently targeted, according to Cisco Talos incident response reports from 2022.

🛡️ Mitigation

Mitigation includes blocking execution of untrusted Office macros, applying patches for CVE-2017-11882 and CVE-2021-40444, deploying endpoint detection rules (e.g., Sigma rule win_susp_csharp_streamer_beacon), and using network segmentation to limit lateral movement. Organizations should also enable Windows Defender Attack Surface Reduction (ASR) rules to prevent process injection.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.