UPX-packed PE32 RAT disguised as xmrig crypto miner (.elf extension fake). NtUnmapViewOfSection process hollowing. AVICAP32 webcam capture. GDI+ screenshot. FtpPutFileA FTP data exfiltration. URLDownloadToFileA second-stage download. ShellExecuteA CMD execution.
FalseXmrigRAT f38504f5 UPX PE32 x86 355KB. NtUnmapViewOfSection process hollowing. AVICAP32 webcam. GdipFree screenshot. FtpPutFileA FTP exfil. URLDownloadToFile. xmrig madenci taklidi.
阅读报告 →