Inhalt nur in Originalsprache verfügbar
class="post-article">
RAT C/C++ Aktiv seit 2024

FalseXmrigRAT

UPX-packed PE32 RAT disguised as xmrig crypto miner (.elf extension fake). NtUnmapViewOfSection process hollowing. AVICAP32 webcam capture. GDI+ screenshot. FtpPutFileA FTP data exfiltration. URLDownloadToFileA second-stage download. ShellExecuteA CMD execution.

Bedrohungsprofil
Typ RAT
ProgrammierspracheC/C++
C2-ProtokollFTP/HTTP
Erstmals gesehen2024
Ziele Kuresel
Zweck / Fähigkeiten
  • Remote Access/Stealer/Webcam/Screenshot
Für diese Familie wurden noch keine C2-Server identifiziert.

Forschungsberichte (1)

Yüksek

FalseXmrigRAT f38504f5 -- NtUnmapViewOfSection Process Hollowing AVICAP32 Webcam GdipFree Screenshot FtpPutFileA FTP Exfil URLDownloadToFileA UPX Packed xmrig Kimligiyle Taklitci | Yuksek

FalseXmrigRAT f38504f5 UPX PE32 x86 355KB. NtUnmapViewOfSection process hollowing. AVICAP32 webcam. GdipFree screenshot. FtpPutFileA FTP exfil. URLDownloadToFile. xmrig madenci taklidi.

Bericht lesen →