STX RAT Targets Finance Sector With Advanced Stealth Tactics

A newly identified remote access trojan, STX RAT, was observed in an attempted attack on a financial services environment; it uses multi-stage script-based delivery, in-memory execution (PowerShell and reflective loading), XXTEA/Zlib unpacking, registry and COM persistence, encrypted C2 traffic, and delayed credential-stealing to evade detection.