Contenu disponible en langue originale
class="post-article">

GoRAT

Go-based AsyncClientRAT. writeKeyLog TLS session key logging. victim string. WriteProcessMemory SetThreadContext process injection. CryptUnprotectData PFXImportCertStore credential theft. CreateServiceW persistence. SMB/DNS lateral movement.

Profil de menace
Type RAT
Langage de programmationGo
Protocole C2TLS/HTTPS
Première détection2023
Cibles Küresel
Objectif / Capacités
  • Remote Access/Credential Theft/Lateral Movement
Aucun serveur C2 n'a encore été identifié pour cette famille.

Rapports de recherche (1)

Kritik

AsyncClientGoRAT -- writeKeyLog KeyLogWriter TLS Oturum Anahtarı Kaydı, victim Kurban Takip Stringi, WriteProcessMemory SetThreadContext Proses Enjeksiyonu, CryptUnprotectData PFXImportCertStore Kimlik Çalma | Kritik

Go tabanlı AsyncClient.exe 4MB RAT. writeKeyLog KeyLogWriter TLS oturum anahtari kaydedici. victim kurban takip stringi. WriteProcessMemory SetThreadContext proses enjeksiyonu. CryptUnprotectData PFXImportCertStore kimlik calma.

Lire le rapport →