A recent security analysis details the architecture and capabilities of Xan-RAT, a C#-based remote access trojan derived from the Quasar RAT codebase.
Recent security analysis has detailed the capabilities and architecture of Xan-RAT, also known as Cold Xan RAT. The C#-based remote access trojan is derived from the Quasar RAT codebase and features publicly available source code on GitHub.
What Happened
Security reporting has highlighted the mechanics of Xan-RAT, providing visibility into how the malware operates on compromised Windows systems. Because the complete source code is publicly accessible on GitHub, researchers can examine the implementation of its features and methods for maintaining persistence.
Operators control the malware through a Command and Control (C2) panel, which displays incoming client data including IP addresses, usernames, computer names, operating systems, privilege levels, countries, client versions, and current statuses. To ensure continuous access, the trojan utilizes scheduled tasks and registry Run keys to survive system restarts, alongside a mechanism to cycle through configured C2 hosts to re-establish connection.
Key Details
- Based on the Quasar RAT codebase and written in C#.
- Complete source code is publicly available on GitHub.
- Persistence achieved via scheduled tasks and registry Run keys.
- C2 panel displays host metadata such as IP address, username, computer name, OS, privilege level, country, client version, and status.
- Built-in modules include Remote Desktop, System Backdoor, Network, Hidden Desktop (HVNC), Stealer, Keylogger, Webcam, Passwords, Remote Execute, System Information, and Power Manager.
- Operators can run shell commands, execute files, and interact with both active desktops and separate HVNC sessions.
Why It Matters
The public availability of Xan-RAT's source code allows security professionals to study how remote access trojans implement persistence, surveillance, and credential-theft capabilities on Windows systems. Understanding the modular design and C2 communication methods of threats derived from the Quasar codebase aids defenders in identifying and mitigating similar intrusion attempts.
