SmartRAT Analysis

SmartRAT is a Brazil-focused banking RAT implemented entirely in PowerShell and identified by the embedded string SMART_V25. Its primary objective is remote access and financial data theft through capabilities such as fake bank-branded password forms, keylogging, and QR code interception.

Setup and configuration

SmartRAT decrypts two C2 server configurations. The first is decrypted using XOR with the key 2, resolving to c[.]windowsupdate-cdn[.]com. The fallback C2 is an IP address that is decrypted using XOR with the key 233, resolving to 162[.]141[.]111[.]227. The malware uses the port number 51888 for communication. SmartRAT also hides the running PowerShell window using user32.dll’s ShowWindow function.

Debug logs are written to C:\ProgramData or %APPDATA%\Microsoft\Diagnosis\ETW\client_debug.log, with a fallback to %TEMP%\client_debug.log. A per-process log is also created at C:\ProgramData\Microsoft\Diagnosis\ETW\process_<PID>.log to silently record all RAT activity.

SmartRAT generates a unique identity token by hashing (SHA-256) the machine GUID, MAC address, UTC ticks, a newly generated GUID, and the computer name. It stores this token in etw.dat and install.token. 

SmartRAT then computes an HMAC-SHA256 of this token value using a hardcoded master key (iuhbdaubdvauygd5562$3@##$r). The hardcoded master key is used for two distinct purposes: the HMAC operation uses the raw UTF-8 bytes of the master key plaintext as its secret, while the 32-byte AES encryption key is derived from the SHA-256 hash of the same string. The encryption and decryption of C2 command traffic is handled by the following two functions, respectively:

• Initialize-xVxIaX (encrypt): Uses AES-CBC to encrypt plaintext. It generates a fresh IV on each call via $aes.GenerateIV(), ensuring identical plaintext produces different ciphertext. The IV and ciphertext are each hex-encoded separately and returned as a colon-delimited string (<ivHex>:<ciphertextHex>) for transmission.
• Start-LXqXSB (decrypt): Splits the colon-delimited input into IV and ciphertext, hex-decodes both, and decrypts the payload using the same AES key to recover the plaintext command.

Persistence and privilege strategy

SmartRAT checks its privilege level by comparing the current Windows identity's SID against S-1-5-18 (the well-known LocalSystem SID), or by checking whether it was launched with the -ServiceMode flag. If either condition is true, SmartRAT connects to the C2 immediately. Otherwise, the code performs the following steps:

1. Copies itself to %APPDATA%\Microsoft\Diagnosis\ETW\msedgeupdate.txt.
2. Attempts to establish persistence by creating a logon-triggered scheduled task named MicrosoftEdgeUpdateCore. If task creation fails, it falls back to registry-based persistence by writing a MicrosoftEdgeUpdateCore value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run that launches a PowerShell command to re-execute SmartRAT (msedgeupdate.txt) at each user logon.
3. Prompts for User Account Control (UAC) elevation.
   1. If UAC elevation is approved: SmartRAT compiles inline C# service code using csc.exe and installs a Windows service named MicrosoftEdgeUpdateCore under %ProgramData%\Microsoft\Diagnosis\ETW\. This service is configured to run with System privileges. After the SmartRAT PowerShell process is created, the code creates a watchdog that checks every 5 seconds to ensure it continues to run. Otherwise, the watchdog relaunches SmartRAT.
   2. If UAC elevation is denied: No Windows service is created. Instead, SmartRAT launches a hidden PowerShell process that bypasses the UAC logic and beacons to the C2. The scheduled task (if created) will prompt for UAC elevation again at the next logon.

SmartRAT also compiles another C# component that uses DuplicateTokenEx and CreateProcessAsUser to spawn a new PowerShell process using the current user’s session, even when the RAT is running as SYSTEM.

SmartRAT supports multiple command-line parameters that control service installation, removal, persistence cleanup, and how the malware runs. The table below lists the parameters that are supported.

Table 1: Command-line parameters supported by SmartRAT. 

SmartRAT outputs the string SMART_V25 along with the current timestamp as a simple confirmation that the RAT executed successfully.

Operator capabilities and victim interaction

Before connecting to the C2, the following C# classes (which are embedded in SmartRAT’s PowerShell code) are compiled and loaded into memory:

• NativeInput: Handles mouse and keyboard inputs, including freezing the victim's input.
• WinEUpjgHelper: Captures the screen using BitBlt (GDI). This class is compiled into memory, but never invoked at runtime. The active screen capture path uses System.Drawing.Graphics.CopyFromScreen().
• WindowMonitor: Retrieves the foreground window title and process name.
• InputTracker: A high-priority keylogger that monitors all keystrokes.
• IdleDetector: Tracks user inactivity using GetLastInputInfo.
• QRDetector: Detects QR codes using pixel pattern analysis.
• DisplayOverlay: Renders full-screen fake overlays, including Windows Update, BSOD, and bank-branded security screens for major Brazilian banks.
• QROverlay: Displays fake overlays with bank branding.

Monitor enumeration 

To map a victim’s screen coordinates and resolution, SmartRAT enumerates all screens and collects each display's full boundaries (X, Y, width, height). It calls SetProcessDpiAwareness (shcore.dll) to bypass DPI scaling and obtain true physical pixel values, then stores the results in a global array so the operator can select a monitor index and accurately align overlays and screen captures.

SmartRAT also tracks banking activity using a window title watchlist, shown in the table below:

Table 2: Window-title keywords SmartRAT monitors to detect banking, payment, and cryptocurrency-related activity.

If the window title matches a list of predefined targets, SmartRAT logs the title, matched keyword, process name, and timestamp, and sends this information to the SmartRAT C2 server as a BrowserAlert (message type 0x80). This serves as a tipoff to the operator that the victim is interacting with a financial application.

Acting on this alert, the operator can then issue a dataEntry: command containing bank-specific branding parameters (name, color palette, prompt text, input length). This SmartRAT feature can be used to launch a full-screen overlay such as a bank verification prompt as shown in the figure below.

Figure 4: Example of fake overlay which can be shown to its victims.

The information captured in the overlay form is then exfiltrated to the SmartRAT C2.

Post-infection / infrastructure weakness

SmartRAT attempts to connect to its C2 server indefinitely. If domain resolution fails, it falls back to a hardcoded IP address. Once a connection is established, SmartRAT communicates over a raw TCP socket on port 51888. Each message uses the binary framing represented in the figure below:

Figure 5: SmartRAT C2 message format.

During connection attempts and initial setup, SmartRAT sends the message types shown in the table below.

Table 3: SmartRAT C2 message types.

SmartRAT features 

After connecting, SmartRAT enters a continuous loop and performs the following high-level tasks:

• Idle detection: Pauses screen capture after > 20 minutes of inactivity and resumes on user activity.
• Incoming packet processing: Processes up to 20 C2 packets per main loop iteration.

The table below shows the C2 messages handled by SmartRAT:

Table 4: Smart SmartRAT C2 commands.

SmartRAT also supports the following features:

• Automatic screen streaming: Captures and streams screenshots to the operator at configurable intervals. The default interval is set to 12 milliseconds.
• QR auto-detection: Identifies QR codes on banking sites and sends QR information to the C2 (supports QR-swap workflows).
  • When QR auto-detection is enabled by the C2 via the AutoQRToggle (0x64) command, the client scans all connected monitors every 3 seconds using a heuristic pixel-contrast and clustering algorithm to locate QR-code-shaped regions on screen. Upon detection, it captures the full monitor as a JPEG, computes the QR's bounding box coordinates, and transmits them to the C2 via the QRCodeDetected (0x65) packet, including the screenshot, region coordinates (X/Y/W/H), monitor offset, and a deduplication hash.
  • In QR-swap workflows, the C2 performs the actual QR decoding server-side and can then respond with a ShowQROverlay (0x66) command containing a threat actor-supplied QR image, which the client renders as a borderless TopMost window positioned at the exact pixel coordinates of the original QR, effectively swapping the legitimate banking QR with the threat actor's, so the victim unknowingly scans and authorizes a fraudulent transaction. The overlay persists until dismissed via HideQROverlay (0x67), and failed-decode regions are blacklisted for 30–60 seconds to avoid redundant transmissions.
• Keylogger streaming: Continuously uploads the victim’s keystrokes to the C2.

SmartRAT is managed from a web-based C2 panel as shown in the figure below.

Figure 6: SmartRAT C2 panel.

Based on verbose explanatory comments and frequent emoticons, the panel’s page source suggests the use of AI tools during development. More importantly, the panel contained critical authentication weaknesses that exposed its C2 functionality, consistent with code deployed without adequate security review. Further inspection revealed that the panel’s “authentication” logic relied only on the presence of two localStorage values (authToken and currentUser) to hide the login overlay. There was no server-side validation of these values before granting access to the panel UI.

<body>
 <!-- Script inline para evitar flash da tela de login -->
 <script>
   if (localStorage.getItem('authToken') && localStorage.getItem('currentUser')) 
{
           document.write('<style>#loginOverlay{display:none!important}</style>');
       }
 </script>
 <!-- 🔐 TELA DE LOGIN -->
 <div class="login-overlay" id="loginOverlay">
   <div class="login-container">
     <div class="login-logo">
       <img src="images/logo-samurai.jpg" alt="Logo">
       <h1>MyGood PRO</h1>
       <p>Sistema de Acesso Remoto</p>

Because the check is performed entirely client-side, a user could bypass the login screen by setting arbitrary values for authToken and currentUser in the browser’s localStorage. The figure below shows the panel, including the sidebar populated with threat actor-controlled values.

Figure 7: SmartRAT C2 panel administration page.