A new malware, CrystalRAT, offered as a service, is being advertised on Telegram. It allows remote control, data exfiltration, keylogging, and clipboard manipulation.

This malware surfaced in January with a subscription-based pricing structure. Besides the Telegram channel, the MaaS was also advertised on YouTube through a dedicated marketing channel demonstrating its functionalities.

Kaspersky researchers report that the malware shares significant similarities to WebRAT (Salat Stealer), including a similar interface, code written in Go, and a comparable sales system employing bots.

CrystalX also incorporates numerous prank-related functions designed to irritate users or disrupt their activities. Despite these “fun” aspects, CrystalX provides extensive data-stealing capabilities.

Kaspersky notes that the malware includes an intuitive control panel and an automated building tool that allows for customization, such as geoblocking, executable modifications, and anti-analysis measures (anti-debugging, virtual machine detection, proxy detection, etc.).

The resulting payloads are protected using zlib compression and ChaCha20 symmetric stream cipher encryption.

The malware establishes a WebSocket connection to the command-and-control server (C2), transmitting host information for profiling and tracking infections.

CrystalX’s data-stealing component, which Kaspersky discovered is currently disabled for an upcoming update, targets Chromium-based browsers utilizing the ChromeElevator tool, along with Yandex and Opera. Additionally, it gathers data from desktop applications such as Steam, Discord, and Telegram.

The remote access component enables the execution of commands via CMD, file uploads and downloads, file system browsing, and real-time machine control via integrated VNC.

The malware also demonstrates spyware-like behavior by recording video and audio from the microphone.

Finally, CrystalX includes a keylogger that streams keystrokes in real-time to the C2, and a clipper tool that uses regular expressions to find wallet addresses in the clipboard, replacing them with attacker-controlled addresses.

What distinguishes CrystalX in the crowded MaaS landscape is its wide array of prankware capabilities.

According to Kaspersky, the malware can perform the following actions on compromised devices:

• change the desktop background
• rotate the display at various angles
• force the system to shut down
• reassign mouse button functions
• disable input devices (keyboard, mouse, monitor)
• display fake notifications
• alter the cursor’s location on the screen
• hide various interface elements (desktop icons, the taskbar, Task Manager, and the Command Prompt executable)
• create a chat window between the attacker and the victim

While these features may not directly increase the attack’s profitability for cybercriminals, they make the product stand out and could entice inexperienced or novice threat actors to purchase a subscription.

Another purpose for the prank features could be to manipulate or distract the victim while the data theft modules operate in the background.

To minimize the risk of malware infections, users are advised to be careful when interacting with online content and to avoid downloading software or media from unreliable or unofficial sources.