Block a user
Windows .NET remote-access trojan (RAT) with an enabled keylogger.
Configured callback: retrac.ethanremote.co.uk, TCP port 300. Uses encrypted messages and automatic reconnection.
Installs a hidden copy at %APPDATA%\SubDir\subDirsystem.exe and attempts persistence through a startup entry named SecurityHealthsrane. Records keystrokes and active window titles, storing logs under %APPDATA%\Logs.
Remote capabilities include screen viewing, mouse/keyboard control, webcam and microphone capture, file upload/download/deletion, shell commands, process and registry management, reverse proxying, and downloading/running additional programs.
Additional code attempts administrator elevation, Defender exclusions, and blocking security websites through the Windows hosts file. These actions are conditional; some routines occur after the connection loop.
Incomplete features in this sample: stored-password retrieval returns an empty list, and the rootkit download URL is a placeholder.
Findings are based on static analysis of Update.exe. The executable was not run, and control-server availability was not checked.
Updated 2026-10-07 19:51:36 +00:00