Hostile ^92% windows Download

client(4).exe

SparkRAT backdoor detected

Detect SparkRAT using string found in the source codeGo module path is opaque random

SHA-2560cf09b6b6bd0161ab1c53e333379ff7c9dac4dde29fcdd44112e45dd0d5cbb2b

URLhttps://tria.ge/api/v0/samples/260824-nazrtsfn5y/sample

MaleculeO₂(ErXe)H₈(Cm₉Cr₇Db₂DsF₂Hf₂Os₆Po₆)Md(Pt)Th

Evidence

ChaCha quarter-round rotation schedule 0x1fb46d–0x1fb52d

⋯3 more rows
0x1fb49d899c2420010000418d9a6e64203331d3..$ ...A..nd 31.
0x1fb4adc1c310418d141f8954247c4431d2c1c2...A....T$|D1...
0x1fb4bd0c458d3c12458dbf6e6420334431fbc1.E.<.E..nd 3D1..
⋯7 more rows

ECDH key-agreement API reference 0x392795–0x392875

⋯4 more rows
0x3927d56f74696679000b6c6f61645365737369otify..loadSessi
0x3927e56f6e000b636572746966696361746500on..certificate.
0x3927f50b63727970746f2f65636468000b7363.crypto/ecdh..sc
0x392805616c61724f72646572010b47656e6572alarOrder..Gener
⋯7 more rows

Go forwarding dial routine 0x392cd7–0x392d97

⋯3 more rows
0x392d0774000b2a5b315d5b5d696e743332000bt..*[1][]int32..
0x392d17666f72776172644469616c000b737562forwardDial..sub
0x392d2770726f746f636f6c000b726561644d61protocol..readMa
⋯7 more rows

References a Go WebSocket connection type 0x3a21be–0x3a229e

⋯3 more rows
0x3a21ee33325d5b5d2a6162692e54797065001732][]*abi.Type..
0x3a21fe2a776562736f636b65742e70726f7879*websocket.proxy
0x3a220e5f4469616c657200172a776562736f63_Dialer..*websoc
0x3a221e6b65742e70726f78795f736f636b7335ket.proxy_socks5
0x3a222e00176477416c6c6f636174696f6e4772..dwAllocationGr
⋯7 more rows

Detect SparkRAT using string found in the source code 0x450a2e–0x450bae

⋯7 more rows
0x450a9e20285a5a5a756e642e746d7068747470 (ZZZund.tmphttp
0x450aae50494e474c4f434b5555494461726368PINGLOCKUUIDarch
0x450abe504f53547061746866696c6561726773POSTpathfileargs
⋯15 more rows