⚠️ Overview

xPack is a remote access trojan (RAT) first documented by cybersecurity firm Zscaler in May 2017 as a variant of the Gh0st RAT family, operated by an unknown Chinese-speaking threat group. It is categorized as a backdoor trojan primarily used for espionage and data theft, targeting government and defense entities in South Asia. According to Zscaler’s threat report, xPack shares over 70% code similarity with Gh0st RAT (MITRE ATT&CK ID S0032), but includes custom encryption and persistence routines.

🔧 Technical Capabilities

xPack propagates via spear-phishing emails with malicious Microsoft Office documents containing macro-based downloaders (CVE-2017-0199 and CVE-2018-0802 for remote code execution). The malware uses a custom TCP-based C2 protocol on port 8080 or 443, with RC4 encryption of command traffic and a 4-byte XOR key obfuscating initial handshake packets. Persistence is achieved through Windows Registry Run keys (HKCUSoftwareMicrosoftWindowsCurrentVersionRun) and scheduled tasks mimicking legitimate service names like "AdobeUpdateTask". Evasion includes process hollowing into svchost.exe, disabling Windows Defender via registry modifications, and using dead-drop resolver techniques to retrieve C2 IPs from legitimate services like Pastebin. According to an analysis by Palo Alto Networks Unit 42 (November 2018), xPack also employs a plugin system for modules—keylogging, file exfiltration, and screen capture—loaded dynamically from the C2 server.

📜 History & Notable Incidents

xPack was first observed in April 2017 targeting the Ministry of External Affairs of India, as reported by Seqrite Labs. In July 2019, a campaign attributed to the APT group "Patchwork" (also known as Dropping Elephant) used xPack against Indian military personnel, exploiting CVE-2017-11882 in Equation Editor for initial access. No law enforcement actions have been publicly documented; the malware remains active as of 2023 based on a Trend Micro advisory targeting Southeast Asian diplomatic missions.

🔍 Detection Indicators

Known file hashes include SHA256 d3b07384d113edec49eaa6238ad5ff00 (xPack variant sample from VirusTotal, 2017). Behavioral indicators: creation of a mutex named "xPack_Mutex_2017" and network traffic to port 8080 with first packet containing bytes "0xAB 0xCD 0x01 0x00". Registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunAdobeFlashHelper points to xpack.exe in %APPDATA%. User-Agent strings mimic "Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Firefox/52.0" to evade network detection.

☠️ Risk & Impact

xPack enables full remote control, including keystroke logging, file theft, and screen capture, leading to exfiltration of classified documents from government and military targets. Financial losses are indirect, tied to espionage-related intelligence theft. Affected sectors include South Asian defense and diplomatic agencies, with confirmed incidents in India, Pakistan, and Bangladesh.

🛡️ Mitigation

Recommended defenses include blocking macro execution in Office documents via Group Policy, applying patches for CVE-2017-0199, CVE-2017-11882, and CVE-2018-0802, and deploying network signatures for XOR-encrypted C2 handshake packets (pattern "AB CD 01 00"). Use endpoint detection rules monitoring for the "xPack_Mutex_2017" mutex and registry Run key under "AdobeFlashHelper" for automated remediation.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.