MostereRAT: A Deep Dive into an EPL-Backed Phishing Operation

MostereRAT: EPL-Backed Phishing Campaign Targets Japanese Organizations

Summary

In 2025, a sophisticated phishing campaign was discovered in Japan, delivering MostereRAT, a stealthy and highly capable Remote Access Trojan (RAT). This campaign uses Easy Programming Language (EPL), encrypted channels, and advanced evasion techniques to bypass defenses and gain full control over compromised systems. By combining social engineering, malware staging, and service manipulation, attackers achieve persistent remote access, disable security tools, and exfiltrate sensitive data.

Attack Details

The attack begins with phishing emails containing links that download malicious files. Victims are tricked into opening booby-trapped Word documents with embedded archives, launching the infection chain.

Key elements of the attack include:

• Payload Delivery: Malicious document.exe is bundled with celebrity images to evade suspicion.

• Privilege Escalation & Persistence: Payloads are dropped in the ProgramData folder, launched via Windows Service Control Manager with elevated privileges. Two malicious services execute scripts and modules, with a fake Simplified Chinese message used as a distraction.

• EPL Abuse: Attackers leverage EPL to compile modules into EPK files decrypted and loaded dynamically in memory, allowing creation of hidden services with SYSTEM or TrustedInstaller rights and execution of scheduled tasks via XML.

• Defense Evasion: MostereRAT blocks security tools (similar to EDRSilencer), terminates critical processes, disables updates, deletes system files, and removes scheduled tasks.

• Secure C2 Communication: Uses SHA-256 validation and encrypted HTTP, TCP, and mTLS connections to prevent C2 impersonation.

• Post-Exploitation: Attackers deploy AnyDesk, TigerVNC, Xray, and RDP Wrapper for remote control, log keystrokes, capture screens, monitor windows, and exfiltrate files.

• Persistence Mechanisms: Hidden admin accounts with non-expiring passwords are created to maintain long-term access.

Recommendations

• Exercise Email Caution: Verify unexpected links or attachments before opening.

• Deploy Advanced Endpoint Security: Use NGAV and EDR with behavioral analysis and ML-based detection to catch memory-resident malware and service abuse.

• Monitor for Anomalies: Investigate suspicious services, new user accounts, fake messages, and unknown scheduled tasks.

• Harden Systems: Apply strict privilege management and restrict access to Service Control Manager and registry modifications.

• Continuous Threat Hunting: Look for signs of AnyDesk/TigerVNC misuse, EPK modules, and abnormal network communications over mTLS.

Indicators of Compromise (IoCs)

Domains

• www[.]efu66[.]com

• mostere[.]com

• huanyu3333[.]com

• idkua93dkh9590764478t18822056bck[.]com

• osjfd923bk78735547771x3690026ddl[.]com

• zzzzzzz0379098305467195353458278[.]com

• xxxxxx25433693728080140850916444[.]com

SHA256 Hashes

• d281e41521ea88f923cf11389943a046557a2d73c20d30b64e02af1c04c64ed1

• 4e3cdeba19e5749aa88329bc3ac67acd777ea7925ba0825a421cada083706a4e

• 546a3418a26f2a83a2619d6c808985c149a0a1e22656553ce8172ca15622fd9b

• 3c621b0c91b758767f883cbd041c8ef701b9806a78f2ae1e08f932b43fb433bb

• 926b2b9349dbd4704e117304c2f0edfd266e4c91fb9325ecb11ba83fe17bc383

MITRE ATT&CK TTPs

• Initial Access: T1566 (Phishing), T1566.002 (Spearphishing Link)

• Execution: T1204 (User Execution), T1204.001 (Malicious Link), T1204.002 (Malicious File), T1059 (Command and Scripting Interpreter), T1203 (Exploitation for Client Execution)

• Persistence: T1547 (Boot or Logon Autostart), T1053 (Scheduled Task/Job), T1543 (Create/Modify System Process), T1136 (Create Account)

• Privilege Escalation: T1068 (Exploitation for Privilege Escalation), T1574.001 (DLL Hijacking)

• Defense Evasion: T1027 (Obfuscation), T1140 (Deobfuscation), T1070 (Indicator Removal), T1562 (Impair Defenses), T1036 (Masquerading)

• Discovery: T1033 (System Owner/User Discovery), T1082 (System Information Discovery)

• Collection: T1056 (Input Capture), T1113 (Screen Capture)

• Exfiltration: T1041 (Exfiltration Over C2 Channel)

• Command & Control: T1090 (Proxy), T1071 (Application Layer Protocol), T1071.001 (Web Protocols)

References

• Fortinet – MostereRAT Deployed with AnyDesk & TightVNC for Covert Access

• MITRE ATT&CK Techniques