WTSSessionHijacker

RDP/WTS session hijacking tool using Windows Terminal Services API (wtsapi32.dll). Enumerates all RDP sessions (WTSEnumerateSessionsW), steals user tokens (WTSQueryUserToken), performs credential-based logon (LogonUserW), and escalates via authz.dll (AuthzAddSidsToContext). Clears event logs (ClearEventLogA) and can control services (ControlService). 300KB encrypted .rsrc payload decrypted at runtime. API calls obfuscated with custom XOR encoding.

Profil de menace

Type RAT

Langage de programmationC/C++

Protocole C2custom

Première détection2024

Cibles Kuresel/Kurumsal

Objectif / Capacités

RDP Hijack/Lateral Movement

Aucun serveur C2 n'a encore été identifié pour cette famille.

Rapports de recherche (1)

Yüksek 2 Tem 2026

WTSSessionHijacker 068af801 -- WTSEnumerateSessionsW WTSQueryUserToken LogonUserW AuthzAddSidsToContext ClearEventLogA ControlService RDP Token Theft 300KB Encrypted rsrc | Yuksek

WTSSessionHijacker 068af801 PE32 x86 396KB. WTSEnumerateSessionsW WTSQueryUserToken. LogonUserW + AuthzAddSidsToContext SID eskalasyon. ClearEventLogA. 300KB sifreli rsrc payload.

Lire le rapport →