General
-
Target
https://www.mediafire.com/file/fv9veoyx2lf2x66/GX_Image_Logger.zip/file
-
Sample
240326-mm4e4sbb2x
Score
10/10
Malware Config
Extracted
Family
xenorat
C2
jctestwindows.airdns.org
Mutex
Xeno_rat_nd8913d
Attributes
-
delay
5000
-
install_path
temp
-
port
45010
-
startup_name
WindowsErrorHandler
Extracted
Family
growtopia
C2
https://discord.com/api/webhooks/1199763266872803338/8vedcXoMcyExhe1xhBm5f8ncmafWmOB3pkulE0l8g9Pel0t3ziyr2V51cLTVEjYsE4Rj
Targets
-
-
Target
https://www.mediafire.com/file/fv9veoyx2lf2x66/GX_Image_Logger.zip/file
Score10/10-
Detect ZGRat V1
-
Growtopia
Growtopa is an opensource modular stealer written in C#.
-
XenorRat
XenorRat is a remote access trojan written in C#.
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Creates new service(s)
-
Stops running service(s)
-
Legitimate hosting services abused for malware hosting/C2
-