XenoRAT UpdateWindowns a87cf095 -- xeno rat client String Tespiti, SharpDX DirectX Ekran Yakalama, Global 7B2A1-9D2E-4F3C Mutex, AddToStartupNonAdmin Kalicilik, localto.net Tunel Relay | Yuksek

파일 Kimligi

xeno rat client: String Tespiti

xeno rat client        (x3 referans)\nxeno rat client.exe    (x2 referans)\n\n-- XenoRAT: acik kaynak C# RAT (GitHub: moom825/xeno-rat)\n-- Costura ile DLL embed: SharpDX.Direct3D11, SharpDX.DXGI\n-- AddToStartupNonAdmin: admin olmadan startup kaydi\n-- Global\{7B2A1-9D2E-4F3C-8A11-B2C3D4E5F6G7} mutex

SharpDX DirectX Ekran Yakalama

SharpDX.Direct3D11.dll.compressed (283,136 byte)\nSharpDX.DXGI.dll.compressed (148,480 byte)\nSharpDX.dll.compressed (274,944 byte)\n\n-- DirectX 11 ile GPU-hizlandirmali ekran yakalama\n-- Standart GDI BitBlt yerine: daha hizli, AV tespiti daha zor\n-- SharpDX = .NET DirectX sarici\n-- DXGI: swap chain ile ekran icerigi al\n-- Kullanim: canli ekran izleme, uzaktan goruntuleme

localto.net: Tunel Relay

localto.net\n\n-- Localto.net: HTTP/TCP reverse tunnel servisi (ngrok benzeri)\n-- Operator kendi C2 IP adresini saklamak icin kullanir\n-- Kurban gelen baglanti: localto.net subdomain\n-- Subdomain arkasinda operator makinesi\n-- AV/Firewall: mesgul domain (localto.net) gorunce whitelist gecebilir\n-- XenoRAT operatoru konfigurasyona kendi localto.net subdomain giriyor

UpdateWindowns Lur Adi

"UpdateWindowns.exe"\n-- "Windowns" = Windows typo (Windows degil)\n-- Sahte Windows Update gibi gosterilmis\n-- Sosyal muhendislik: IT personeline veya kullaniciya "Windows guncelleme" diye sunulmus\n-- Future timestamp: zaman damgasi sahte (anti-analiz)

IOC