General
-
Target
https://www.mediafire.com/file/fv9veoyx2lf2x66/GX_Image_Logger.zip/file
-
Sample
240326-mm4e4sbb2x
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.mediafire.com/file/fv9veoyx2lf2x66/GX_Image_Logger.zip/file
Resource
win10v2004-20240226-en
windows10-2004-x64
18 signatures
150 seconds
Malware Config
Extracted
Family
xenorat
C2
jctestwindows.airdns.org
Mutex
Xeno_rat_nd8913d
Attributes
-
delay
5000
-
install_path
temp
-
port
45010
-
startup_name
WindowsErrorHandler
Extracted
Family
growtopia
C2
https://discord.com/api/webhooks/1199763266872803338/8vedcXoMcyExhe1xhBm5f8ncmafWmOB3pkulE0l8g9Pel0t3ziyr2V51cLTVEjYsE4Rj
Targets
-
-
Target
https://www.mediafire.com/file/fv9veoyx2lf2x66/GX_Image_Logger.zip/file
-
Detect ZGRat V1
-
Creates new service(s)
-
Stops running service(s)
-
Legitimate hosting services abused for malware hosting/C2
-