Tropidoor

Tropidoor is a Windows malware family operated by WageMole.

Background

Tropidoor is a capable HTTP/S Remote Access Trojan (RAT) implemented as a C project that shares a substantial amount of code with the PostNapTea RAT. During November 2024 it featured in operations aimed at developers, where fake recruiters drove a social engineering effort that distributed trojanized open-source projects on services such as Bitbucket. It serves as the final-stage payload in a multi-stage execution chain that also delivered an obfuscated build of BeaverTail.

For network traffic, the RAT encrypts and decrypts using both RSA and AES. Its C2 exchanges rely on particular HTTP POST parameters, namely tropi2p, gumi, s_width, and letter, the first of which loosely inspired the malware's code name. The configuration is kept in a binary layout, and the necessary Windows APIs are resolved at runtime through the Fowler–Noll–Vo (FNV) hash function, while many of its distinctive strings are XOR encrypted.

One notable trait is that it reimplements a range of Windows administrative and reconnaissance commands internally. Because this logic runs inside the RAT rather than spawning the genuine Windows binaries, its command activity is harder for behavioral monitoring tools to spot. The internally provided commands replicate the behavior of standard utilities such as:

arp dir ipconfig kill net netsh netstat nslookup ping reg rm sc schtasks systeminfo tracert wmic logicaldisk wmic process

Source: Malpedia (Fraunhofer FKIE).