Overview of the x47.c Botnet
A newly identified Windows botnet named x47.c is being sold by a threat actor known as WraithTools, offering a range of malicious capabilities including distributed denial-of-service (DDoS) attacks, credential theft, SOCKS5 proxy services, and an innovative AI API draining function. According to security researchers at Qrator, the botnet is designed to maintain persistence on infected hosts using artificial intelligence, specifically leveraging the xAI Grok model to automate system manipulation tasks.
Pricing and Available Modules
In early August, the botnet’s base package was advertised for $200, with a DDoS add-on available for an additional $150. The complete x47.c package, which includes all available features, was priced at $950. This full package grants users access to a web-based command-and-control (C&C) panel that enables management of infected machines, configuration of fast-flux networks, viewing of information stealer logs, proxy management, concealment tools, and DDoS attack orchestration.
DDoS Capabilities and AI API Draining
The C&C panel’s DDoS section provides access to 18 distinct attack methods. These include standard volumetric attacks such as HTTP floods, TCP and UDP floods, as well as more sophisticated techniques like slow HTTP attacks, TLS stressers, and various reflection and amplification vectors. Among these, the AI API drain mode stands out for its unique purpose: rather than overwhelming network bandwidth, it is designed to consume a victim’s allocated AI service credits by making direct requests to AI providers.
To activate this feature, the operator supplies a valid API key and a model name for accounts on platforms including OpenAI, xAI Grok, and other compatible chat APIs. Because these requests are sent directly to the AI service providers and do not route through the victim’s application, the targeted website or service may remain accessible even as the underlying AI account exhausts its credits or incurs unexpected charges.
Persistence via AI-Driven Automation
The x47.c botnet includes an "AI stealth" module designed to maintain long-term access to compromised Windows systems. This module uses the xAI Grok model to select from a predefined set of persistence actions, such as creating registry startup entries or scheduling tasks. The operator must embed an xAI API key into the bot’s build to enable these AI-driven decisions.
According to Qrator’s analysis, the AI model generates status messages that report on system changes, including successful persistence repairs, additions to Windows Defender exclusion lists, and fallback actions when AI queries fail. These fallback mechanisms ensure that the bot can continue maintenance operations locally even if the AI model does not respond, thereby increasing resilience.
Additional Features: Rootkit, Privilege Escalation, and Data Theft
The botnet also offers optional capabilities such as process hollowing and privilege escalation to deepen system access. A promoted rootkit module is designed to remove competing malware or security tools from infected systems, helping the botnet maintain exclusive control.
For monetization and intelligence gathering, x47.c can harvest a wide range of sensitive data from victims, including browser-stored passwords and cookies, Discord tokens, cryptocurrency wallet data, and authentication tokens from AI-powered sites. Infected machines can also be used to relay traffic through a SOCKS5 proxy network, with the operator able to monitor proxy health, connection status, and timeout metrics in real time.
Fast-Flux Infrastructure for Resilience
To resist takedown efforts, the botnet employs a fast-flux configuration managed through the C&C panel. This setup involves six domains and eight IP addresses associated with the botnet’s infrastructure, allowing the operator to rapidly shift control points. Individual bots can be configured with preferred hostnames and IP addresses to optimize communication and evade detection.
Source: SecurityWeek