TLDR Tech / InfoSec
CrystalX: unpacking a Go RAT through three encrypted layers
CrystalX, a MaaS RAT first reported by Kaspersky in March, hides a 6.9 MB Go payload inside a compact Windows loader using three sequential transforms: position-dependent XOR, ChaCha20, then raw DEFLATE, with the unpacked payload adding a fourth layer of AES-GCM encryption over all runtime strings. Once peeled, the RAT establishes a WebSocket C2 over TLS to crystalxrat[.]net, authenticating via a hardcoded builder token, and supports 40+ commands spanning remote desktop, webcam streaming, keylogging, credential theft from browsers and messaging apps (Discord, Telegram, and Steam), and destructive toggles including BSOD and display rotation. Defenders should hunt for the build-ID-seeded persistence artifacts (NvContainerTask_YBFZUW1U32, SecurityHealthSystray.exe under DeviceMetadataStore, Global\WinSecMutex_YBFZUW1U32) and apply the published YARA rule targeting the loader's ChaCha20 key and XOR transform pattern.
Read the full story