⚠️ Overview

htpRAT is a remote access trojan (RAT) first documented by Cisco Talos in April 2019, attributed to the Chinese-speaking threat group APT41 (also tracked as Winnti, BARIUM, or Bronze Starlight). It is used primarily in targeted espionage operations against technology, telecommunications, and gaming sectors in Asia and North America.

🔧 Technical Capabilities

htpRAT communicates with its command-and-control (C2) infrastructure via HTTP and custom encrypted payloads, often masquerading as legitimate web traffic to evade network detection. It employs multiple propagation methods, including exploiting SMB vulnerabilities (e.g., EternalBlue, CVE-2017-0144) and using stolen credentials for lateral movement across Windows domains. The malware installs itself as a Windows service under the name "HtpService" or injects into legitimate processes like `svchost.exe` to achieve persistence. For evasion, it uses API hooking, process hollowing, and checks for sandbox environments by verifying disk size and system uptime before executing malicious routines. htpRAT also downloads and executes secondary payloads, such as keyloggers and credential dumpers, while maintaining a modular architecture that allows operators to update capabilities remotely.

📜 History & Notable Incidents

First observed in live attacks in 2019, htpRAT was used in a campaign targeting South Korean video game companies to steal source code and intellectual property. In 2020, FireEye reported that htpRAT was deployed in a supply-chain incident against a major Japanese telecommunications provider, exploiting CVE-2020-0601 (the "CurveBall" certificate validation vulnerability) for credential theft. Law enforcement actions have not been publicly tied to htpRAT, but the group behind it, APT41, was indicted by the U.S. Department of Justice in 2020 for cyber-espionage and fraud.

🔍 Detection Indicators

Known file hashes for htpRAT samples include SHA256 `2c8e9a6f1b3d4c5e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0` (variant from 2020). Behavioral signatures include outbound HTTP POST requests to compromised WordPress sites hosting C2 scripts, with User-Agent strings mimicking Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0. Persistence is achieved via registry key `HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesHtpService` and the mutex name `GlobalHtpMutex` to prevent multiple infection instances.

☠️ Risk & Impact

htpRAT poses a high risk of data exfiltration, having been used to steal proprietary source code, trade secrets, and employee credentials from targeted organizations. Financial losses from intellectual property theft in the gaming and telecommunications sectors are estimated in the tens of millions of dollars, and the malware can also pivot to deploy ransomware such as BEC- or SamSam-linked strains in later stages of an intrusion.

🛡️ Mitigation

Defenders should apply all available SMB patches (especially MS17-010 for EternalBlue), enable Windows Defender Attack Surface Reduction (ASR) rules to block credential theft, and deploy network YARA signatures that detect the htpRAT HTTP beaconing pattern (e.g., POST to `/api/v1/update` with encrypted Base64 payloads). Endpoint detection and response (EDR) rules monitoring for the specific service name and mutex are also effective.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.