{"id":"6ab8540db2cc96cd482583c84b2bac2a","title":"Go QUIC/WASM RAT — Go QUIC/WASM RAT · 木马/恶意软件 · PE32","md5":"6ab8540db2cc96cd482583c84b2bac2a","sha256":"615a472ec89ed0f34c7c4a51131e19ee154b2e49d70bf51f04119de521c05d48","family":"Go QUIC/WASM RAT","apt":null,"verdict":null,"sample_type":"木马/恶意软件","lang":"Go","file_format":"PE32","compiler":"Go(UPX)","published_at":"2026-08-06T16:00:00.000Z","summary":"该样本为 Go 语言编译的 Windows PE32 后门程序, 经 UPX 5.02 LZMA 压缩(压缩前12MB)。具备极其先进的技术特征: 1) QUIC(HTTP/3)协议 C2 通信, 利用 UDP 443 端口规避传统 TCP/TLS 检测; 2) 集成 wazero WebAssembly 运行时, 可动态加载和执行任意 WASM 模块化载荷; 3) 通过 WebSocket + SOCKS5 代理实现多层隧道; 4) 利用 Task Scheduler 实现持久化; 5) 目标浏览器包括 Chrome/Chrome SxS/Firefox/Comodo IceDragon/Elements Browser/Sputnik, 并窃取 NSS 数据库和 LSASS 凭据; 6) 内含大量 Chrome 扩展 ID 列表用于针对性凭据窃取; 7) 使用 DNS over HTTPS(Cloudflare/Google)和 WMI 进行系统侦察。内置 NIST P-256 椭圆曲线加密, 支持 DuplicateTokenEx 令牌窃取。此样本代表了高度定制化的 APT 级后门工具。","url":"https://zseceye.com/report/6ab8540db2cc96cd482583c84b2bac2a","json_url":"https://zseceye.com/report/6ab8540db2cc96cd482583c84b2bac2a.json","html_url":"https://zseceye.com/report/6ab8540db2cc96cd482583c84b2bac2a","hash_urls":{"md5":"https://zseceye.com/hash/6ab8540db2cc96cd482583c84b2bac2a","sha256":"https://zseceye.com/hash/615a472ec89ed0f34c7c4a51131e19ee154b2e49d70bf51f04119de521c05d48"},"search_urls":{"md5":"https://zseceye.com/?q=6ab8540db2cc96cd482583c84b2bac2a","sha256":"https://zseceye.com/?q=615a472ec89ed0f34c7c4a51131e19ee154b2e49d70bf51f04119de521c05d48"},"sample_download_url":"https://zseceye.com/report/6ab8540db2cc96cd482583c84b2bac2a/sample","sample_filename":"615a472ec89ed0f3.zip","iocs":[],"ips":[]}