General
-
Target
https://github.com/ColossusYTTV/GorillaTag-Account-Manager/releases/download/1.0/GtagAccountManager.exe
-
Sample
250330-elercszshv
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/ColossusYTTV/GorillaTag-Account-Manager/releases/download/1.0/GtagAccountManager.exe
Resource
win10v2004-20250314-en
Malware Config
Extracted
crimsonrat
185.136.161.124
Extracted
warzonerat
168.61.222.215:5400
Extracted
lokibot
http://blesblochem.com/two/gates1/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
https://github.com/ColossusYTTV/GorillaTag-Account-Manager/releases/download/1.0/GtagAccountManager.exe
-
CrimsonRAT main payload
-
Crimsonrat family
-
Floxif family
-
Lokibot family
-
Modifies WinLogon for persistence
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Detects Floxif payload
-
Warzone RAT payload
-
Downloads MZ/PE file
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Impair Defenses: Safe Mode Boot
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Modifies WinLogon
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1