x47.c is a Windows-based botnet sold by a threat actor named WraithTools, leveraging AI (xAI Grok) to maintain persistence and select predefined actions such as startup entries and scheduled tasks. It provides a command-and-control panel with features for managing bots, configuring fast-flux domains, launching 18 types of DDoS attacks including AI API draining (which consumes victims' AI service credits directly), and stealing credentials including browser passwords, cookies, Discord tokens, wallet data, and AI-site tokens. The botnet supports process hollowing, privilege escalation, rootkit modules to remove competing malware, and SOCKS5 proxy relay functionality. Operators can update or remove software on infected hosts and monitor proxy health. The AI stealth module uses an xAI key embedded in the build to maintain persistence and repair itself even if AI calls fail.

The botnet enables distributed denial-of-service attacks that can exhaust network and system resources of targeted victims. The AI API draining attack can cause financial damage by depleting victims' paid AI service credits without disrupting their websites. Credential theft capabilities risk exposure of sensitive user data, including passwords, cookies, Discord tokens, and wallet information. The use of rootkits and privilege escalation increases the difficulty of detection and removal. The fast-flux configuration enhances resilience against takedown efforts. Overall, x47.c poses a multifaceted threat combining resource exhaustion, financial impact, and data theft.

No official vendor advisory or patch information is available for this threat. Mitigation should focus on detection and removal of the x47.c botnet on infected Windows hosts. Network defenders should monitor for unusual outbound traffic patterns consistent with DDoS or AI API draining attacks and inspect for signs of fast-flux domain usage. Endpoint detection and response tools should be employed to identify persistence mechanisms such as scheduled tasks, startup entries, process hollowing, and rootkit activity. Credential theft can be mitigated by enforcing multi-factor authentication and rotating credentials if compromise is suspected. Since this is a malware campaign without a patch, incident response and host remediation are primary defenses.