IXESHE Derivative IHEATE Targets Users in America

Trend Micro analysis of an IHEATE (IXESHE-family) backdoor observed targeting users in the United States. The report details a sample (SHA1: 3de8ef34fb98ce5d5d0ec0f46ff92319a5976e63) that uses TCP-layer C2, custom RC4-based and RSA-1024-protected session key encryption, a suite of remote backdoor commands, impersonation of a Windows Media Player DLL, and C2 infrastructure that includes compromised or re-registered domains and hardcoded addresses. The analysis provides network and file-level indicators, C2 behavior, and concludes that IXESHE/IHEATE remains an evolving targeted threat.