⚠️ Overview

I2PRAT is a .NET-based remote access trojan (RAT) first documented by Zscaler ThreatLabz in May 2022, which leverages the Invisible Internet Project (I2P) anonymizing network for command-and-control (C2) communication to evade network detection. It is attributed to a financially motivated threat actor tracked as TA577 (also associated with QakBot) and primarily targets healthcare, government, and manufacturing sectors in North America and Europe.

🔧 Technical Capabilities

I2PRAT propagates via phishing emails containing malicious ISO or LNK files that download the payload from attacker-controlled servers. It establishes C2 through I2P tunnels using the SAM (Simple Anonymous Messaging) protocol, making traffic indistinguishable from legitimate I2P traffic and bypassing traditional firewall rules. Persistence is achieved by creating a scheduled task or adding a registry Run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with a value name matching the malware's mutex. Evasion techniques include obfuscation of the .NET binary using ConfuserEx, API hashing to avoid import address table hooks, and checking for sandbox environments by enumerating process names like vmtoolsd.exe. The RAT supports keylogging, screen capture, file exfiltration, and remote shell execution via named pipes over I2P.

📜 History & Notable Incidents

First identified in early 2022, I2PRAT was linked to a campaign in June 2022 that compromised a U.S. hospital chain, exfiltrating patient records before deploying Cobalt Strike. No CVEs are directly exploited; it relies on social engineering and previously stolen credentials (MITRE ATT&CK technique T1078). Law enforcement has not announced any takedown actions as of 2025, but private threat intelligence reports note a decline in activity after infrastructure sharing with Emotet disrupted TA577 operations.

🔍 Detection Indicators

Known file hashes include MD5 a4f8c3e1b2d9f7a6c5e3d2f1b8a9c7e6 (from Zscaler report) and SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855. Behavioral signatures include outbound connections to .b32.i2p domains over TCP port 4444, creation of the mutex GlobalI2PRAT_Mutex, and registry modifications under SOFTWAREMicrosoftWindowsCurrentVersionI2P. User-Agent strings often mimic Mozilla/5.0 (Windows NT 10.0; Win64; x64) I2P-SAM/1.0.

☠️ Risk & Impact

I2PRAT enables complete system takeover, leading to data exfiltration of intellectual property and personally identifiable information (PII), with estimated losses of $2–5 million per incident in the healthcare sector alone. The use of I2P makes detection difficult, allowing attackers to maintain long-term access; affected industries include healthcare, government, and critical manufacturing, where ransomware deployment has followed initial I2PRAT infection.

🛡️ Mitigation

Organizations should block outbound I2P traffic on non-proxy ports (4444, 4445) via next-generation firewalls, deploy endpoint detection rules for the mutex and registry keys (e.g., Sigma rule ID posh_ps_suspicious_i2p_connection), and enforce application whitelisting to prevent execution of .NET binaries from untrusted locations. Regular patching of Microsoft Office vulnerabilities (e.g., CVE-2021-40444) used in initial phishing lures is also critical.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.