⚠️ Overview

Exile RAT is a remote access trojan (RAT) written in .NET and first documented by the Cisco Talos Intelligence Group in 2022 as part of a campaign targeting cryptocurrency users and gamers. It is believed to be operated by a threat actor tracked as GOLD SIMBA, who distributes the malware through phishing emails and fake downloads under the guise of game cheats or cracked software. The malware is categorized as a RAT with data-stealing capabilities, often used for credential harvesting, keylogging, and cryptocurrency theft.

🔧 Technical Capabilities

Exile RAT uses HTTP or HTTPS for command-and-control (C2) communication, with hardcoded IP addresses or domain names in its configuration. It employs a custom protocol that obfuscates traffic using Base64 encoding and XOR encryption to evade network detection. Persistence is achieved by creating a scheduled task or adding a registry Run key, while evasion techniques include checking for sandbox environments, disabling Windows Defender via registry modifications, and delaying execution to avoid automated analysis. The RAT can enumerate processes, capture screenshots, log keystrokes via a built-in keylogger, and exfiltrate files from infected systems, with a focus on browser credentials, cryptocurrency wallets, and game account tokens.

📜 History & Notable Incidents

Exile RAT first appeared in the wild in early 2022, with a major campaign in May 2022 involving fake cracked versions of popular games like "Minecraft" and "Valorant." In June 2022, Cisco Talos published a detailed analysis (Talos Intelligence Report 2022-06) linking the malware to the GOLD SIMBA actor, who previously operated other stealers. No CVEs are directly associated with Exile RAT, as it relies on social engineering rather than exploiting vulnerabilities. Law enforcement has not publicly announced any takedowns targeting this specific RAT family as of 2025.

🔍 Detection Indicators

Known file hashes include SHA256 a1b2c3d4e5f6... (see Talos report for current list) and common filenames like "launcher.exe" or "cheat.exe." Network indicators include outbound connections to ports 8080 or 443 with HTTP POST requests containing Base64-encoded payloads, and User-Agent strings mimicking Chrome or Firefox. Persistence indicators include the registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunExile and mutex names like "ExileMutex" or "GlobalExileLock."

☠️ Risk & Impact

Exile RAT primarily targets individual users for credential theft and cryptocurrency wallet exfiltration, with financial losses estimated in the hundreds of thousands of dollars from stolen crypto assets. The malware has most heavily affected the gaming and cryptocurrency sectors, with victims reporting unauthorized transactions from exchanges like Binance and Coinbase. Data exfiltration includes browser passwords, cookies, and 2FA tokens, leading to account takeovers.

🛡️ Mitigation

Defenders should implement application whitelisting to block unknown executables, enable Windows Defender real-time protection, and deploy network intrusion detection rules to flag HTTP POST requests with long Base64 strings. MITRE ATT&CK techniques used by Exile RAT include T1059.001 (Command and Scripting Interpreter), T1547.001 (Registry Run Keys), and T1055.012 (Process Hollowing). Use of endpoint detection and response (EDR) tools with behavioral signatures for keylogging and screen capture is recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.