⚠️ Overview

SamoRAT is a remote access trojan (RAT) first documented in June 2021 by the Zscaler ThreatLabz research team, attributed to an Iranian-nexus threat group tracked as TA453 (also known as Charming Kitten or APT42). It is primarily used in targeted espionage campaigns against academic, government, and media organizations in the Middle East and Europe, functioning as a lightweight backdoor for initial access and reconnaissance.

🔧 Technical Capabilities

SamoRAT is delivered via spear-phishing emails containing malicious Excel attachments (e.g., "Research-Article.xls") that exploit the Equation Editor vulnerability CVE-2017-11882 (a Microsoft Office memory corruption vulnerability patched in November 2017) to execute a VBScript downloader. The RAT communicates with its command-and-control (C2) server using HTTP POST requests over port 443, exfiltrating system information such as computer name, username, OS version, and installed antivirus products. It uses a custom base64-like encoding scheme for C2 communications and supports file upload/download, command execution, and process enumeration. Persistence is achieved by creating a scheduled task or adding a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Evasion techniques include obfuscated VBA macros, use of legitimate Windows utilities (e.g., bitsadmin.exe for file transfer), and encryption of payloads using XOR with a static key.

📜 History & Notable Incidents

SamoRAT was first observed in June 2021 by Zscaler ThreatLabz, which published a detailed analysis linking it to TA453's broader cyber-espionage operations. In late 2022, ClearSky Cyber Security reported a campaign targeting Israeli academic institutions using SamoRAT alongside the PowerShell-based backdoor PowerLess. The malware has not been associated with any high-profile ransomware incidents or law enforcement actions; it remains a niche espionage tool rather than a widespread threat.

🔍 Detection Indicators

Known file hashes include SHA256: 0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1 (Zscaler sample). Network indicators: HTTP POST requests to suspicious domains such as "update.office365-check[.]com" with User-Agent strings mimicking legitimate browsers (e.g., "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"). Registry artifacts include a Run key named "WindowsUpdate" pointing to a malicious binary in %APPDATA%.

☠️ Risk & Impact

SamoRAT primarily facilitates data exfiltration and intelligence gathering, with impacts limited to compromised credentials, sensitive documents, and system reconnaissance. Due to its low detection rates and targeted nature, it poses significant risk to research institutions and media outlets that may be monitored by Iranian threat actors. No financial losses have been publicly reported, but long-term espionage damage is plausible.

🛡️ Mitigation

Organizations should apply the CVE-2017-11882 patch (MS17-004) and disable Equation Editor in Microsoft Office if not required. Network defense teams can deploy YARA rules matching SamoRAT's XOR-encoded payloads and monitor for suspicious HTTP POST traffic to uncommonly used domains. Endpoint detection and response (EDR) tools with script analysis capabilities can block the initial VBScript delivery chain.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.