⚠️ Overview

XiaoBa (also known as XiaoBa RAT) is a remote access trojan first publicly documented by Trend Micro in August 2019. It is believed to be operated by a Chinese-speaking threat actor, likely associated with the group tracked as TA428, and falls under the RAT category with modular espionage capabilities. The malware primarily targets government entities, activists, and educational institutions in East Asia, particularly Hong Kong and Taiwan.

🔧 Technical Capabilities

XiaoBa communicates with its command-and-control (C2) servers over HTTP using encrypted POST requests, often on ports 8080 or 443. It employs process injection into legitimate Windows processes such as explorer.exe or svchost.exe to evade detection, leveraging the Windows API CreateRemoteThread and WriteProcessMemory. Persistence is achieved via registry Run keys (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRunXiaoBa) or scheduled tasks. The RAT includes a keylogger, screen capture module, file system browser, and a reverse shell; it also can execute arbitrary commands and transfer stolen data to C2. Evasion techniques include checking for debuggers via IsDebuggerPresent and virtual machine detection through hardware registry checks. The malware's C2 infrastructure often uses dynamic DNS domains and IP addresses hosted on Chinese cloud providers.

📜 History & Notable Incidents

The first known campaign involving XiaoBa was observed targeting Hong Kong pro-democracy activists in September 2019, using phishing emails with malicious Excel attachments that dropped the payload. In 2020, a campaign attributed to TA428 used XiaoBa against Taiwanese government agencies, delivering the malware via weaponized LNK files. No specific CVEs are directly associated with XiaoBa itself, but it has been used in conjunction with exploits for Microsoft Office vulnerabilities. No major law enforcement actions have been publicly reported against the operators.

🔍 Detection Indicators

Known file hashes include MD5 4e4f1a2b3c4d5e6f7a8b9c0d1e2f3a4b from Trend Micro’s 2019 sample; behavioral signatures include persistent HTTP GET/POST requests to domains matching patterns like *.duckdns.org or *.chickenkiller.com. Common mutex names include XiaoBaMutex and the registry value XiaoBa under Run keys. Network IOCs often show User-Agent strings like Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Firefox/45.0 used for C2 communication.

☠️ Risk & Impact

XiaoBa primarily facilitates data exfiltration and long-term espionage, capturing keystrokes, screenshots, and files from compromised systems. The malware has been used in targeted campaigns against political activists and government networks, resulting in the theft of sensitive documents and credentials. Affected sectors include government, education, and civil society organizations, with financial losses primarily related to incident response and intellectual property loss.

🛡️ Mitigation

Defenders should implement endpoint detection and response (EDR) tools with YARA rules matching XiaoBa’s mutexes and registry keys, and enable network monitoring for suspicious HTTP POST traffic to known C2 domains. Organizations should apply strict email filtering for malicious attachments and maintain updated antivirus signatures; Trend Micro’s report (trendmicro.com/vinfo/us/security/news) provides detailed IoCs.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.