DeafNews
// 1 ZERO-DAY IN THE LAST 24H→
Malware

Fake SSN Site Delivers StreamRat and XWorm with Platform-Specific Payloads

Published: Updated: By Samuel Segato 6 min read Malware
Share
WhatsApp Facebook X (Twitter) LinkedIn Reddit Telegram Email
CERT-AGID analyzed a campaign abusing the Italian National Health Service brand to distribute full-featured RATs on Android and Windows. The payloads use dynamic, C2-driven HTML overlays and fileless execution to evade traditional detection.

CERT-AGID published its analysis on January 15, 2024, of a malicious campaign impersonating the Italian National Health Service (Servizio Sanitario Nazionale) to distribute malware with full remote-access capabilities. The threat does not target the healthcare sector directly but exploits its institutional credibility as a social-engineering lure, employing platform-specific technical mechanisms that make traditional detection difficult. The key finding: both payloads are full-feature RATs controllable via C2, with a dynamic overlay architecture that allows changing targets without redistributing the malware.

Key Takeaways
  • The fake SSN page checks the browser User-Agent and delivers SSN.apk on Android or SSN Windows.bat on Windows, with platform-specific infection mechanisms.
  • StreamRat on Android uses a native library with a 40-byte XOR key to decode a secondary payload, abuses accessibility services, and communicates with the C2 via WebSocket over TLS to receive dynamic HTML overlays.
  • XWorm on Windows executes entirely in memory through a BAT → PowerShell → fake JPG download with Base64 payload → System.Reflection.Assembly::Load() chain, without writing to disk.
  • StreamRat contains no hardcoded target app list: it reports the foreground application to the server and receives the specific overlay page, making the malware adaptable to any service.

Delivery Mechanism: User-Agent Fingerprinting and Dual-Front Approach

The campaign operates through a single entry point that masks its dual nature. CERT-AGID documents that the fake site analyzes the visitor's browser User-Agent and automatically selects the appropriate payload: SSN.apk for Android devices, SSN Windows.bat for Windows systems. This discrimination is not a simple cosmetic redirect but an active delivery logic that maximizes infection compatibility with the victim's platform.

The choice of the National Health Service as bait is deliberate. According to CERT-AGID, "the healthcare theme represents the central point of the campaign and is used as a trust element to convince the user to execute the received file." The immediate risk for Italian users is high: the SSN enjoys universal recognition and health urgency lowers perceptual defenses. However, the dossier makes clear that the SSN name is exclusively a lure: actual targets are determined dynamically by the command-and-control server.

Android Chain: XOR Decoding, Dual APK, and C2-Driven Overlays

CERT-AGID's technical analysis reconstructs the StreamRat chain with forensic granularity. The initial APK contains a native library that uses a 40-byte XOR key to decode a secondary payload, then installed as an independent application. This second stage obtains Android accessibility permissions, a functional requirement for screen capture and touch/swipe simulation.

Communication with the C2 occurs via WebSocket over TLS, a channel that appears as standard encrypted web traffic. Here emerges StreamRat's most distinctive characteristic: the absence of predefined targets. As CERT-AGID documents, "StreamRat communicates to the server which application is in the foreground and can dynamically receive the page to display for that specific package." The value of zero hardcoded target applications in the APK means a single sample can switch from banking overlay to healthcare interface to cryptocurrency forms without a binary update.

The HTML overlay is rendered above the legitimate app, capturing user input the victim believes is destined for the authentic application. CERT-AGID does not specify which services have actually been impersonated through this dynamic mechanism.

Windows Chain: In-Memory Execution and Absence of Disk Artifacts

The Windows branch presents a different but equally problematic technical profile for detection. The initial BAT file is an obfuscated loader that launches PowerShell with a hidden window. From there begins a sequence CERT-AGID has reconstructed in its essential stages: download of a file named '2.jpg' from randomized URLs, extraction of Base64 content between <<START>> and <<END>> markers, and direct in-memory loading.

"The code is loaded directly into PowerShell memory through System.Reflection.Assembly::Load()"
— CERT-AGID

The end result is the execution of XWorm, a Windows RAT for remote control of the compromised computer. The absence of disk writes for the .NET payload eliminates an entire category of indicators of compromise that traditional defenses rely on: no executable file to analyze, no signature to match, no filesystem persistence to detect. The brief does not specify whether XWorm installs additional persistence mechanisms beyond the initial in-memory load.

Recommended Actions

CERT-AGID has not issued specific operational guidance for users, but the campaign structure enables targeted actions. For the Android branch: check for installed apps named "SSN" or unknown packages, review active accessibility permissions, and monitor persistent WebSocket connections to domains not attributable to official Italian institutional services. The 40-byte XOR key and dual APK are relevant technical indicators for security teams conducting forensic analysis on suspicious devices.

For the Windows branch: search browser history for downloads of JPG files from URLs with randomized patterns and analyze PowerShell logs for calls to System.Reflection.Assembly::Load(). The BAT → PowerShell → in-memory execution chain is the distinctive pattern to use in detection rules. Do not rely solely on on-disk antivirus scans: the XWorm payload leaves no filesystem trace during the initial phase.

For both platforms: treat with suspicion any communication that requires downloading executable files whenever it uses the National Health Service name. The SSN does not distribute official apps through sites outside the governo.it domain and never requires installation of APKs or BAT scripts to access services.

Analysis: Flexibility as a Mass-Precision Weapon

The campaign analyzed by CERT-AGID illustrates an inversion in remote-access malware logic. Historical RATs were specialized tools: configured for a target, distributed for an objective. StreamRat and XWorm in this configuration represent the opposite: a generic architecture that the server makes specific at the moment of infection. The healthcare factor is contingent, not structural: it could be replaced by any other institutional theme without modifying the malware code.

This separation between lure and capability makes the campaign particularly difficult to classify and defend against. Defenses based on healthcare domain reputation do not intercept the banking payload served subsequently; detection rules for specific overlays fail because the target changes dynamically. The value for the C2 operator lies in reusability: same infrastructure, multiple campaigns, zero redistribution costs.

For Italian readers and organizations, the practical lesson lies in the misalignment between perception and risk. The user who recognizes the SSN logo and lowers their guard does not suffer a theft of health data but surrenders remote control of their device, with all the consequences that compromise entails in banking, professional, or personal contexts.

Information is based on the cited source and current as of publication.

Sources

Sources and references
  1. cert-agid.gov.it