STX RAT: The New Financial Predator Hiding in the “Start of Text”

eSentire’s TRU identified STX RAT, a sophisticated remote access trojan targeting the finance sector that uses VBScript and trojanized FileZilla installers for delivery, supports a hidden VNC (HVNC) remote desktop, gates credential/data theft behind active C2 interaction, employs strong evasion (string obfuscation, AMSI Ghosting, API hashing) and secures C2 with X25519/Ed25519 over TCP with Tor fallback, representing a high-risk stealthy threat to financial organizations.