<![CDATA[i've got a new malware analysis describing what i have dubbed XorBee RAT]]>i've got a new malware analysis describing what i have dubbed XorBee RAT

  • delivered by via
  • Python based
  • targets domain-joined Windows
  • uses port tcp/4444 for C2 traffic
  • obfuscates C2 traffic with XOR of the letter b
  • continuously runs a thread checking for monitoring tools and exists if seen
  • after authenticating with C2, enters reverse shell
  • related to ModeloRAT
  • first seen in October 2025

Link Preview Image
XorBee RAT

A technical breakdown of XorBee RAT, a Python-based reverse shell deployed by the KongTuke threat actor via ClickFix social engineering against domain-joined Windows environments.

favicon

Malware Analysis (rmceoin.github.io)

]]>https://board.circlewithadot.net/topic/140cc88d-d636-415a-a43e-d296af848b79/i-ve-got-a-new-malware-analysis-describing-what-i-have-dubbed-xorbee-ratRSS for NodeThu, 30 Apr 2026 15:50:57 GMTMon, 13 Apr 2026 17:10:27 GMT60<![CDATA[Reply to i've got a new malware analysis describing what i have dubbed XorBee RAT on Thu, 16 Apr 2026 20:04:25 GMT]]>@BrandonD i don't really know what their criteria is for the gateway url with the /g path. they do seem to toggle it off for periods of time. i speculate they only have it enabled during victim business hours and when they're on the clock, so to speak.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/rmceoin/statuses/116416175520604822https://board.circlewithadot.net/post/https://infosec.exchange/users/rmceoin/statuses/116416175520604822Thu, 16 Apr 2026 20:04:25 GMT<![CDATA[Reply to i've got a new malware analysis describing what i have dubbed XorBee RAT on Thu, 16 Apr 2026 19:58:23 GMT]]>@rmceoin Very interested if you get around to posting the logic they're using for when to display the ClickFix!

Seeing a compromised site that was reaching out to windlrr[.]com/file.js yesterday, now reaching out to a new initial C2: mermiston[.]com/file.js

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/BrandonD/statuses/116416151807326512https://board.circlewithadot.net/post/https://infosec.exchange/users/BrandonD/statuses/116416151807326512Thu, 16 Apr 2026 19:58:23 GMT<![CDATA[Reply to i've got a new malware analysis describing what i have dubbed XorBee RAT on Thu, 16 Apr 2026 19:02:01 GMT]]>@da_667 ah! i just got around to noticing the ET TROJAN XorBee RAT CnC Domain in DNS Lookup rules. those are actually KongTuke domains. those may or may not lead you to XorBee RAT. the RAT didn't use any domains, it only used IP's directly.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/rmceoin/statuses/116415930129006676https://board.circlewithadot.net/post/https://infosec.exchange/users/rmceoin/statuses/116415930129006676Thu, 16 Apr 2026 19:02:01 GMT<![CDATA[Reply to i've got a new malware analysis describing what i have dubbed XorBee RAT on Mon, 13 Apr 2026 18:26:53 GMT]]>@rmceoin python based on windows? curious that's a feasible tactic these days

]]>https://board.circlewithadot.net/post/https://social.treehouse.systems/users/astraleureka/statuses/116398805031937931https://board.circlewithadot.net/post/https://social.treehouse.systems/users/astraleureka/statuses/116398805031937931Mon, 13 Apr 2026 18:26:53 GMT<![CDATA[Reply to i've got a new malware analysis describing what i have dubbed XorBee RAT on Mon, 13 Apr 2026 18:02:26 GMT]]>@da_667 yea! i had a feeling you'd be able to chew on that

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/rmceoin/statuses/116398708912975316https://board.circlewithadot.net/post/https://infosec.exchange/users/rmceoin/statuses/116398708912975316Mon, 13 Apr 2026 18:02:26 GMT<![CDATA[Reply to i've got a new malware analysis describing what i have dubbed XorBee RAT on Mon, 13 Apr 2026 17:58:24 GMT]]>@rmceoin oh hey, that's something I can use. I'll include that in today's release as well. Thank you so much for sharing.

alert tcp-pkt $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE XorBee RAT CNC Checkin M1"; flow:established,to_server; dsize:7; content:"|09 07 1b 52 52 55 68|"; reference:url,rmceoin.github.io/malware-analysis/2026/04/13/xorbee-rat.html; classtype:trojan-activity; sid:1; rev:1;)

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/da_667/statuses/116398693066481277https://board.circlewithadot.net/post/https://infosec.exchange/users/da_667/statuses/116398693066481277Mon, 13 Apr 2026 17:58:24 GMT<![CDATA[Reply to i've got a new malware analysis describing what i have dubbed XorBee RAT on Mon, 13 Apr 2026 17:53:06 GMT]]>@da_667 cool! nice to get an add to ETOPEN. a quick check shows the C2 is still up. fyi, the authentication packet should have the same data payload for any C2 IP, so when they move, this will be the same assuming the AUTH_KEY stays the same

Link Preview ImageLink Preview Image
]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/rmceoin/statuses/116398672213935112https://board.circlewithadot.net/post/https://infosec.exchange/users/rmceoin/statuses/116398672213935112Mon, 13 Apr 2026 17:53:06 GMT<![CDATA[Reply to i've got a new malware analysis describing what i have dubbed XorBee RAT on Mon, 13 Apr 2026 17:42:16 GMT]]>@rmceoin can't see any sandbox results of the traffic, which sucks, but at the very least, I can grab the C2 and drop that into the ETOPEN ruleset for today's release. Thanks for sharing.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/da_667/statuses/116398629609232314https://board.circlewithadot.net/post/https://infosec.exchange/users/da_667/statuses/116398629609232314Mon, 13 Apr 2026 17:42:16 GMT<![CDATA[Reply to i've got a new malware analysis describing what i have dubbed XorBee RAT on Mon, 13 Apr 2026 17:31:45 GMT]]>@james_inthe_box thank you! i saw it back in october and had fun with it, then saw it again last week and it sure seemed like nobody else had written it up. i was overdue for a post on anything and this seemed like an interesting little beastie.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/rmceoin/statuses/116398588263593238https://board.circlewithadot.net/post/https://infosec.exchange/users/rmceoin/statuses/116398588263593238Mon, 13 Apr 2026 17:31:45 GMT<![CDATA[Reply to i've got a new malware analysis describing what i have dubbed XorBee RAT on Mon, 13 Apr 2026 17:13:35 GMT]]>@rmceoin Nicely done.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/james_inthe_box/statuses/116398516847391092https://board.circlewithadot.net/post/https://infosec.exchange/users/james_inthe_box/statuses/116398516847391092Mon, 13 Apr 2026 17:13:35 GMT