FalseXmrigRAT
UPX-packed PE32 RAT disguised as xmrig crypto miner (.elf extension fake). NtUnmapViewOfSection process hollowing. AVICAP32 webcam capture. GDI+ screenshot. FtpPutFileA FTP data exfiltration. URLDownloadToFileA second-stage download. ShellExecuteA CMD execution.
Tehdit Profili
Tür
RAT
Yazılım DiliC/C++
C2 ProtokolüFTP/HTTP
İlk Görülme2024
Hedef Kitle
Kuresel
Amaç / Yetenekler
- Remote Access/Stealer/Webcam/Screenshot
Bu aile için henüz C2 sunucusu tespit edilmemiştir.
Araştırma Raporları (1)
FalseXmrigRAT f38504f5 -- NtUnmapViewOfSection Process Hollowing AVICAP32 Webcam GdipFree Screenshot FtpPutFileA FTP Exfil URLDownloadToFileA UPX Packed xmrig Kimligiyle Taklitci | Yuksek
FalseXmrigRAT f38504f5 UPX PE32 x86 355KB. NtUnmapViewOfSection process hollowing. AVICAP32 webcam. GdipFree screenshot. FtpPutFileA FTP exfil. URLDownloadToFile. xmrig madenci taklidi.
Raporu Oku →