APT36, also known as Transparent Tribe, is a Pakistan-based threat actor notorious for persistently targeting Indian government organizations, diplomatic personnel, and military facilities. APT36 has conducted numerous cyber-espionage campaigns against Windows, Linux, and Android systems.

In recent campaigns, APT36 utilized a particularly insidious Windows RAT known as ElizaRAT. First discovered in 2023, ElizaRAT has significantly evolved to enhance its evasion techniques and maintain reliability in its command and control (C2) communication.

This report focuses on ElizaRAT's evolution. We examine the various payloads and infrastructures employed by APT36 and the malware's inner workings, including deployment methods, second-stage payloads, and the persistent use of cloud infrastructure.

First publicly disclosed in September 2023, ElizaRAT is a Windows Remote Access Tool (RAT) utilized by Transparent Tribe in targeted attacks. ElizaRAT infections are often initiated by CPL files distributed through Google Storage links, likely distributed by phishing. ElizaRAT used Telegram channels in its earlier variants to facilitate Command and Control (C2) communication.

Since its discovery, ElizaRAT's execution methods, detection evasion, and C2 communication have all evolved. This was apparent in three distinct campaigns that utilized the malware at the end of 2023 and the beginning of 2024. In each campaign, the attacker used a different variant of ElizaRAT to download specific second-stage payloads that automatically collect information.

The main characteristics of ElizaRAT include:

(MD5: ) is an ElizaRAT variant that leverages Slack channels as C2 infrastructure. It was compiled at the end of 2023 and is executed as a CPL file. CPL files are directly invoked by a double click, making spear phishing a convenient infection route.

This variant most closely resembles the original variants of ElizaRAT in terms of asynchronous code, functionality, and execution. It follows all the ElizaRAT characteristics and base creation functionality:

To register the victims in the attacker C2, the malware reads the content of and sends it to the C2 server. The malware then continuously checks the C2 for new commands every 60 seconds.

It consists of three classes of code:

The content received from the C2 is processed by the function, which knows how to parse the content and run the related function from the according to the command received from the C2.

The following are the commands the malware can process:

The C2 communication in SlackAPI.dll is managed through the class, which uses Slack's API to interact with the attacker. The function continuously polls the channel via the Slack API at , using the bot token and the victim ID content in the request. This function runs in an endless loop, checking for new commands every 60 seconds.

For message and file handling, the function sends messages to the C2 by posting to with the content and channel ID , while uploads files to the same channel using . The function retrieves files from a provided URL, saving them to the victim's machine using and the bot token for secure access.

The threat actor deployed an additional payload, which we named ApoloStealer, on specific targets. According to the compilation time, the variant of ApoloStealer used in this campaign was compiled one month after the ElizaRAT SlackAPI.dll variant, which might suggest that additional payloads are involved.

ApoloStealer employs techniques similar to other Transparent Tribe malware:

After creating the database file, ApoloStealer creates a table to store data in these fields: filename, file path, flag, type, and modified date. The malware then collects all DESKTOP files that do not start with or and have one of the following extensions:

After storing all the relevant files in the database file, ApoloStealer sends the data to the C2 server at the URL .

The malware repeats the same process for the Downloads directory, OneDrive directory, and each fixed drive on the machine, except for .

Compiled in January 2024, the Circle ElizaRAT variant is an improved version of the malware. It utilizes an additional dropper component, which results in much lower detection rates. The Circle campaign uses a payload that resembles the SlackFiles payload and uses a similar working directory ().

Unlike other ElizaRAT variants, the Circle campaign does not use any cloud service as C2 infrastructure and instead uses a simple virtual private server (VPS) for C2 communication.

The sole purpose of the dropper is to set up the necessities for the execution of ElizaRAT. The function drops and unpacks a zip file embedded as a resource containing the ElizaRAT malware. It also creates the working directory and drops the decoy PDF document and MP4 file. Another feature of the malware, a known characteristic of ElizaRAT, is the creation of an LNK file for the malware, but there is no indication that any of the malware uses it. Note that the description of the LNK is , which also implicates this cluster as part of the Slack campaign.

After dropping the malware, the dropper executes it with a simple function.

This is the ElizaRAT variant utilized in the Circle campaign cluster. It performs the same checks and base creation as all other variants:

To get a new task from the attacker, the malware sends the content of the , with the addition of at the start of the string, to the URL and waits for the response.

There are three tasks the malware can receive from the attacker:

If the malware triggers the function, it will also trigger the function, designed to unpack a zip file.

The zip file contains the SQLite DLL, which will be used in the second-stage payload. It is extracted to , the same working directory as the Slack campaign. If we examine the function, we can see it is designated to execute the stealer.

The fact that this malware is designated to download the payload and use the same working directory as the Slack campaign suggests that these two activity clusters are part of the same campaign.

The initial infection vector used in this campaign is not clear. However, based on the file names, such as and , as well as past campaigns by the threat actor, they were likely sent via spear phishing.

Much like previous versions, the CPL file is a dropper responsible for setting up all the necessities for the next stage, including:

The ElizaRAT variant used in this campaign leverages Google Cloud for its C2 communication. Utilizing the Google C2 channel, the actor sends commands to download the next stage payload from different virtual private servers (VPS). In this campaign, we observed the use of three different VPS.

The main ElizaRAT malware () uses the X.509 certificate to create a object for authenticating a Google Cloud Storage service account: . The email associated with this service account is . The malware checks for the parent folder and lists all the files in that folder. Next, it locates the related victim's tmp1 file, gets the commands and logs its actions.

The only command the malware can process is the command, which directs the malware to download a payload from a specific VPS address. Below is a sample format of the command the malware received for the chosen victims:

The malware splits the command at into an array, where each element represents a specific parameter of the operation:

When processing the command, the following sequence is triggered:

So far, we've seen two payloads utilized in this campaign: and . Both payloads function as info stealers, each designed for a specific purpose. Despite these minor changes, the payloads' core functionality and primary purpose remained consistent throughout the campaign.

The file is downloaded to the victim's machine as or and is executed by the scheduled task, which runs the function via . This payload is a file stealer that collects specific file types, stores their metadata in a database, and exfiltrates it to the C2 server.

First, the malware creates an SQLite database file, which interacts with using the class and the . The SQLite DLL is embedded in the malware in a protected zip file, which the malware extracted using a plain text password.

While iterating over all files on the fixed drives, the malware skips directories such as , , , and to avoid processing system directories. It also filters out files that start with , , or , which are typically system or temporary files. The malware is only interested in these file suffixes:

The malware stores the name, path, and another parameter called for each relevant file. is a boolean variable indicating whether the file was uploaded to the C2. If a file wasn't uploaded to the C2, the malware calls the function, which reads the file's byte content and sends it to the C2 while updating its upload status.

Like the other malware in this campaign, it also hides some of its operations in a text blob, which it splits by (space). The information it tries to hide includes its C2 server and the different web pages it communicates with, even though they are not eventually used:

An additional payload is designed to examine files on external drives, such as USBs. This malware utilizes WMI (Windows Management Instrumentation) to list all relevant files on external drives and targets the same file extensions. However, instead of storing them in a database, it stores them in an archive it creates in the working directory.

The malware uses WMI to monitor the creation of new disk drives every two seconds, most likely to detect the insertion of a USB drive:

For each device, it retrieves the device ID and serial number and checks for the correct disk partition to iterate on. Unlike other ElizaRAT-associated stealers, ConnectX doesn't have a C2 server to exfiltrate the data to; it just stores the data in a zip file in the ElizaRAT working directory %appdata%\BaseFilteringEngine.

ElizaRAT is a custom tool known to be employed exclusively by "Transparent Tribe" against targets similar to those described in this report. This is in addition to other indicators linked to the group's campaigns, including using an overlapping email account in a different activity cluster targeting Linux systems.

Like other malware associated with Transparent Tribe, all the samples presented here used the name . In the Google Drive campaign, the decoy PDF file attributes its authorship to , a distinctive name previously observed in various aspects of Transparent Tribe's operations.

The use of occurs differently in the campaigns. For example, in the Circle dropper, the password is used to uncompress the zip file. In addition, the function responsible for checking the time zone in the payload is also named .

The internal checks the ElizaRAT variants perform suggest the campaigns exclusively targeted Indian systems, evidenced by each malware variant's initial function of verifying whether the system's time zone was set to .

The progression of ElizaRAT reflects APT36's deliberate efforts to enhance their malware to better evade detection and effectively target Indian entities. By integrating cloud services like Google Drive, Telegram, and Slack into their command and control infrastructure, they exploit commonly used platforms to mask their activities within regular network traffic.

Introducing new payloads such as ApolloStealer marks a significant expansion of APT36's malware arsenal and suggests the group is adopting a more flexible, modular approach to payload deployment. These methods primarily focus on data collection and exfiltration, underscoring their sustained emphasis on intelligence gathering and espionage.