WebRAT Go Stealer Analysis

Sample

File

cd9c972e…2a0067.exe (from ZIP, password infected)

SHA-256

cd9c972e46b2cf283be8227c67417a4c5bb2009fc91a14b0845f20d86e2a0067

MD5

1eeff92eb40e0409bab1e159c2e629bb

Type

PE32 GUI, x86, 12.5 MB, 6 sections, Go 1.24

Size of analysis

5,526 procedures · 22,713 strings · 300 main.* functions recovered

How it was analyzed

Command-and-control chain

Code paths also show a Steam-profile decoder (decodeSteam) and a tg:// link finder, which suggests two more places the server address can be hidden. I did not observe either being used.

Capabilities

Indicators of compromise

Not recorded: the real IP of sa1atik.cn and the content the TON domains resolve to, because the sandbox had no network. Treat the Defender exclusions, UAC change and GitLab downloads as capability evidence: the script was in memory, but Wine could not run it.

ATT&CK mapping

YARA rules

Two rules. The first matches the executable on disk. The second matches decrypted config and the dropper script in a process dump.

rule MAL_WebRAT_Go_Stealer_Nov2026
{
    meta:
        description = "Go-based WebRAT-style infostealer / RAT (TON + DoH C2 resolution, Chromium app-bound key theft, keylogger)"
        author      = "analysis via rea + GoReSym + sandbox run"
        date        = "2026-11-01"
        sha256      = "cd9c972e46b2cf283be8227c67417a4c5bb2009fc91a14b0845f20d86e2a0067"
        reference   = "local analysis"

    strings:
        // Go symbol names present in pclntab
        $f1 = "main.decodeFromTonAddress" ascii
        $f2 = "main.tryTonResolve" ascii
        $f3 = "main.GetAppBoundKey" ascii
        $f4 = "main.findLsassProcess" ascii
        $f5 = "main.impersonateSystem" ascii
        $f6 = "main.runKeylogger" ascii
        $f7 = "main.decodeSteam" ascii
        $f8 = "main.DecryptGecko" ascii
        $f9 = "main.staticinstall" ascii

        // operator log / status strings
        $s1 = "steal finished!" ascii
        $s2 = "SSLPIN DISABLED" ascii
        $s3 = "CONN BEST ENABLED" ascii
        $s4 = "found tg:// url" ascii
        $s5 = "bestConnMethod" ascii
        $s6 = "NO PREAPPBENCKEY ERR" ascii
        $s7 = "FOUND BC: GOT RESULT" ascii

        // resolver / lookup endpoints stored in clear
        $r1 = "https://dns.google/resolve?name=" ascii
        $r2 = "SELECT a11, a102 from nssPrivate" ascii

    condition:
        uint16(0) == 0x5A4D and filesize < 30MB and
        (
            ( 5 of ($f*) ) or
            ( 4 of ($s*) and 2 of ($f*) ) or
            ( $r1 and $r2 and $f3 )
        )
}

rule MAL_WebRAT_Go_Stealer_Memory_Config
{
    meta:
        description = "Decrypted C2 config and dropper script in process memory or a memory dump"
        sha256      = "cd9c972e46b2cf283be8227c67417a4c5bb2009fc91a14b0845f20d86e2a0067"
    strings:
        $c1 = "sa1atik.cn" ascii wide
        $c2 = "webratxaye1.ton" ascii wide
        $c3 = "remoteadministratortool.ton" ascii wide
        $c4 = "gitlab.com/webrat1/importantfiles" ascii wide
        $p1 = "Add-MpPreference -ExclusionPath" ascii wide
        $p2 = "reagentc /disable" ascii wide
        $p3 = "EnableLUA" ascii wide
    condition:
        any of ($c*) or all of ($p*)
}

Validation

The static rule keys on Go symbol names, so a rebuild with garble or stripped symbols will evade it. The status strings and DoH endpoint give a second route. Test against a larger clean corpus before deploying it as a blocking rule.

What to do

Limits of this analysis

• The sample ran under Wine without a display and without network, so server commands, the Steam and Telegram paths, and persistence were not exercised.
• main.dec was not reimplemented. The C2 values come from process memory after the program decrypted them itself. There may be more entries the run did not reach.
• Ghidra's Go support failed on this binary, so pseudocode for Go functions is hard to read. Names come from GoReSym.
• Network blocking was the only containment. Bubblewrap and user namespaces were unavailable on the analysis machine.