Contenido disponible en idioma original
class="post-article">
RAT C/C++ Activo desde 2024

FalseXmrigRAT

UPX-packed PE32 RAT disguised as xmrig crypto miner (.elf extension fake). NtUnmapViewOfSection process hollowing. AVICAP32 webcam capture. GDI+ screenshot. FtpPutFileA FTP data exfiltration. URLDownloadToFileA second-stage download. ShellExecuteA CMD execution.

Perfil de amenaza
Tipo RAT
Lenguaje de programaciónC/C++
Protocolo C2FTP/HTTP
Primera detección2024
Objetivos Kuresel
Propósito / Capacidades
  • Remote Access/Stealer/Webcam/Screenshot
Aún no se han identificado servidores C2 para esta familia.

Informes de investigación (1)

Yüksek

FalseXmrigRAT f38504f5 -- NtUnmapViewOfSection Process Hollowing AVICAP32 Webcam GdipFree Screenshot FtpPutFileA FTP Exfil URLDownloadToFileA UPX Packed xmrig Kimligiyle Taklitci | Yuksek

FalseXmrigRAT f38504f5 UPX PE32 x86 355KB. NtUnmapViewOfSection process hollowing. AVICAP32 webcam. GdipFree screenshot. FtpPutFileA FTP exfil. URLDownloadToFile. xmrig madenci taklidi.

Leer informe →