← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
New Winos 4.0 Malware Infects Gamers Through Malicious Game Optimization Apps
WHITE Void Arachne AlienVault 2024-11-06 Modified: 2024-12-06
1
IOCs
LOW VOLUME
A command-and-control framework called Winos 4.0 is being distributed through gaming-related applications, targeting Chinese-speaking users. The malware, rebuilt from Gh0st RAT, uses a multi-stage infection process involving fake BMP files, DLLs, and shellcode. It can harvest system information, capture clipboard content, gather cryptocurrency wallet data, and enable backdoor functionality. Winos 4.0 also allows for additional plugins to capture screenshots and upload sensitive documents. The framework is considered powerful, similar to Cobalt Strike and Sliver, and exploits users' trust in game optimization tools to deploy deep system control.
command-and-controlgh0st ratwinos 4.0cryptocurrency walletsoptimization appsmulti-stage infection
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
Winos 4.0 gh0st RAT - S0032 Mydoor Moudoor
Indicators of Compromise (1)
All domain
TYPEINDICATORDESCRIPTIONCREATED
domain ad59t82g.com — 2024-11-06
References (1)
↗ https://thehackernews.com/2024/11/new-winos-40-malware-infects-gamers.html