FalseXmrigRAT

UPX-packed PE32 RAT disguised as xmrig crypto miner (.elf extension fake). NtUnmapViewOfSection process hollowing. AVICAP32 webcam capture. GDI+ screenshot. FtpPutFileA FTP data exfiltration. URLDownloadToFileA second-stage download. ShellExecuteA CMD execution.

Profil de menace

Type RAT

Langage de programmationC/C++

Protocole C2FTP/HTTP

Première détection2024

Cibles Kuresel

Objectif / Capacités

Remote Access/Stealer/Webcam/Screenshot

Aucun serveur C2 n'a encore été identifié pour cette famille.

Rapports de recherche (1)

Yüksek 2 Tem 2026

FalseXmrigRAT f38504f5 -- NtUnmapViewOfSection Process Hollowing AVICAP32 Webcam GdipFree Screenshot FtpPutFileA FTP Exfil URLDownloadToFileA UPX Packed xmrig Kimligiyle Taklitci | Yuksek

FalseXmrigRAT f38504f5 UPX PE32 x86 355KB. NtUnmapViewOfSection process hollowing. AVICAP32 webcam. GdipFree screenshot. FtpPutFileA FTP exfil. URLDownloadToFile. xmrig madenci taklidi.

Lire le rapport →