TL;DR
- Surx RAT: An Android RAT that downloads additional modules via the internet, including large language models from Hugging Face, for remote control, data theft, and dynamic updates.
- Simple Loader: A first-stage loader exploiting the CVE-2026-21509 vulnerability in a phishing document for code execution, with XOR encryption and persistence via COM objects.
- PhantomProxyLite: A post-exploitation tool in the form of a PowerShell script for organizing a reverse SSH tunnel, providing persistent remote access with persistence in the scheduler.
- Astarion RAT: A RAT delivered via the Matanbuchus malicious loader during attacks initiated by ClickFix social engineering, with functionality for stealing credentials, setting up SOCKS5 proxy, port scanning, reflective code loading, and shell execution.
1) Surx RAT (Android)
Sample: ANY.RUN
Surx RAT is an Android RAT (Remote Access Trojan) that stands out by downloading additional modules via the internet, including large language models (LLM) from the Hugging Face repository to expand its capabilities. Upon infection, the RAT installs a wide range of remote control functions: from stealing SMS, contacts, geolocation, and call logs to audio recording, screenshot capture, covert app installation, and device management. Surx RAT can also update its behavior on the fly by downloading plugins from the network, making it more flexible and resilient compared to ordinary Android RATs.
How to detect: The malware can be detected by the presence of shared preferences files with characteristic names:
/data/data/*/shared_prefs/SurxratPrefs.xml
/data/data/*/shared_prefs/surxrat_prefs.xml
The Android app package name may vary, but the presence of these XML configurations indicates Surx RAT activity.
Key facts:
- Downloads large modules (LLM) from internet resources (e.g., Hugging Face), allowing dynamic expansion of RAT functionality.
- Covertly requests and collects extensive data from the device (SMS, contacts, calls, geolocation, files).
- Can remotely control the device, launch a command shell, take screenshots, and record audio.
- Supports downloading/installing apps without the user's knowledge.
- Data exchange with the C2 server is carried out via HTTP/HTTPS with parameter transmission from prefs configs.
Analytical note:
| Detected | External sources | ANY.RUN Last Submission | Sandbox Evasion |
|---|---|---|---|
| 2026-02-25 | News | 2026-02-25 | 7 |
With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.
TI Lookup:
filePath:"\/SurxratPrefs.xml$" and filePath:"\/surxrat_prefs.xml$"
IOCs:
- SHA256:
05f77799a631b37caf8b27f747867c2808dbc7b91b33bc6768b13de423de872f - FILES:
/data/data/*/shared_prefs/SurxratPrefs.xml/data/data/*/shared_prefs/surxrat_prefs.xml
MITRE:
| Technique ID | Technique Name | Evidence |
|---|---|---|
| T1074.001 | Data Staged: Local Data Staging | Surx RAT collected data in local storage |
2) Simple Loader (Windows)
Sample: ANY.RUN
Simple Loader is a first stage loader. It uses CVE-2026-21509 exploit in a spear-phishing document for code execution.
How to detect: Detected by monitoring abnormal activities related to scheduled tasks and file behavior.
Key facts:
- Simple Loader uses XOR encryption. Loader uses COM object hijacking for persistence.
Analytical note:
| Detected | External sources | ANY.RUN Last Submission | Sandbox Evasion |
|---|---|---|---|
| 2026-02-19 | News | 2026-02-18 | 0 |
With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.
TI Lookup:
filePath:"EhStoreShell.dll$"
IOCs:
- SHA256:
0bb0d54033767f081cae775e3cf9ede7ae6bea75f35fbfb748ccba9325e28e5e - SHA256:
8c1dc9732884c6078b23953b78314a8d0d8b8d9fe42e5f97a7cd09b8ace943a9 - SHA256:
52b6fb40e7efb09c2bebe8550178e7e30009600bdedd1acae085d753761b7598 - SHA256:
a876f648991711e44a8dcf888a271880c6c930e5138f284cd6ca6128eca56ba1
MITRE:
| Technique ID | Technique Name | Evidence |
|---|---|---|
| T1053.005 | Scheduled Task/Job: Scheduled Task | Creates scheduled task from XML file |
| T1546.015 | Event Triggered Execution: Component Object Model Hijacking | Creates/Modifies COM task schedule object |
| T1036.005 | Masquerading: Match Legitimate Resource Name or Location | The process creates files with name similar to system file names |
| T1497.003 | Virtualization/Sandbox Evasion: Time Based Checks | Uses Task Scheduler to run other applications |
3) PhantomProxyLite (Windows)
Sample: ANY.RUN
PhantomProxyLite is a malicious post-exploitation proxy tool designed to organize persistent remote access to a compromised system via a reverse SSH tunneling mechanism. For persistence in the system, a scheduler task is created with execution on behalf of SYSTEM, ensuring automatic tunnel recovery, and configuration parameters are stored in the registry.
How to detect: Detection of PhantomProxyLite is based on identifying characteristic PowerShell activity and specific file artifacts associated with the operation of the malicious SSH tunnel.
Key facts:
- Uses techniques for hidden reverse SSH tunneling via the built-in Windows ssh.exe.
- Implemented as a PowerShell script (Living-off-the-Land).
- Creates a Windows scheduler task (SSHService) with execution from SYSTEM.
- Configuration is stored in the registry, logs — in C:\Windows\Temp.
Analytical note:
| Detected | External sources | ANY.RUN Last Submission | Sandbox Evasion |
|---|---|---|---|
| 2026-02-17 | - | 2026-02-25 | 4 |
With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.
TI Lookup:
filePath:"C:\\Windows\\Temp\\SSHService.log"
IOCs:
- SHA256:
2bb6c2a602ef3d610af41484900ec7f758704e0812b266c5d3afb20ff31cedab - SHA256:
ed1f14c1926514cbb48d7ee39efc3476932d9ee0553c1f06531870249caceaa1 - FILES:
C:\Windows\Temp\SSHService.log
MITRE:
| Technique ID | Technique Name | Evidence |
|---|---|---|
| T1059.001 | Command and Scripting Interpreter: PowerShell | Implementation as a PowerShell script for launching the SSH tunnel |
| T1021.004 | Remote Services: SSH | Organization of a reverse SSH tunnel |
| T1090 | Proxy | Use as a proxy module for traffic redirection |
| T1053.005 | Scheduled Task/Job: Scheduled Task | Creation of a scheduler task (SSHService) with auto-start from SYSTEM |
| T1547.001 | Boot or Logon Autostart Execution: Registry Run Keys | Storage of configuration in the Windows registry |
| T1071 | Application Layer Protocol | Use of legitimate SSH protocol |
| T1562.001 | Impair Defenses: Disable or Modify Tools | Masquerading as standard ssh.exe activity |
| T1036 | Masquerading | Use of the name SSHService and system directories |
| T1573 | Encrypted Channel | Traffic transmission via an encrypted SSH channel |
| T1105 | Ingress Tool Transfer | Use of the tunnel for delivering additional components |
4) Astarion RAT (Windows)
Sample: ANY.RUN
Astarion RAT is delivered via the malicious Matanbuchus loader during attacks initiated by ClickFix social engineering. It has functionality for stealing credentials, setting up SOCKS5 proxy, port scanning, reflective code loading, and shell execution.
How to detect: Detected by connection to C2 (Suricata signature on characteristic URL).
Key facts:
- Uses RC4 encryption for configuration and RSA for metadata.
- Delivered via a compressed PE file, decompressed in memory after XOR decryption.
Analytical note:
| Detected | External sources | ANY.RUN Last Submission | Sandbox Evasion |
|---|---|---|---|
| 2026-02-19 | News | 2026-02-25 | 5 |
With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.
TI Lookup:
url:"/intake/organizations/events\?channel=app"
IOCs:
- DOMAIN:
neremedysoft.com - URL:
/intake/organizations/events?channel=app - SHA256:
16B1819186F0803B9408D9A448A176142F8271A4BC0B42CDB78EB4489BCE16FE
MITRE:
| Technique ID | Technique Name | Evidence |
|---|---|---|
| T1082 | System Information Discovery | Collects system information |
| T1071 | Application Layer Protocol | Connects to C2 |
| T1012 | Query Registry | Collects system information from the registry |
Conclusion
1) ClickFix maintains the status of the main trend in malware delivery: Surx RAT and Astarion RAT use ClickFix for initial infection.
2) Use of vulnerabilities: Simple Loader exploits CVE-2026-21509.
3) Proxy and tunneling: PhantomProxyLite masquerades as legitimate SSH.