OP 08 April, 2023 - 10:57 PM
Advanced Remote Administration Tool
Technical Information:
https://leaked.wiki/p/6xtX6rAZ9V
Features:
- Remote command execution
- Silent background process
- Download and run file (Hidden)
- Safe Mode startup
- UAC Bypass
- Will automatically connect to the server
- Data sent and received is encrypted (substitution cipher)
- Files are hidden
- File Infector
- Symmetric Cryptography
- Hijack Execution Flow: DLL Side-Loading
- Deobfuscate/Decode Files or Information
- Input Capture Keylogging
- Command and Scripting Interpreter
- Installed Antivirus shown to server
- Indicator Removal: Clear Windows Event Logs
- Indicator Removal: File Deletion
- Easily spread malware through download feature
- Startup info doesn't show in msconfig or other startup checking programs like CCleaner
- Disable Task Manager
- TCP Connections
- Non-Application Layer Protocol
- ActiveWindows
- StartupManager
- Registry Editor
- Process Manager
- Clipboard Manager
- Shell
- Installed Programs
- DDos Attack
- VB Net Compiler
- Location Manager [GPS - IP]
- File Manager
- Client [Restart - Close - Uninstall - Update - Block - Note]
- Power [Shutdown - Restart - Logoff]
- More
Download Link:
Virus Scans:
Virus total Report: https://www.virustotal.com/gui/file/b0bc.../community
HTML Report: https://www.joesandbox.com/analysis/379667/0/html
PDF Report: https://www.joesandbox.com/analysis/379667/0/pdf
Executive Report: https://www.joesandbox.com/analysis/379667/0/executive
Incident Report: https://www.joesandbox.com/analysis/379667/0/irxml
IOCs: https://www.joesandbox.com/analysis/3796...analysisid
Virustotal link https://www.virustotal.com/gui/file/b0bc056257f5bee8532b5978c082d9fd173eb07128aea13af83938ca94ebe4dd/community
