GobRAT-Analysis

This repository publishes analysis reports and analysis tools for GobRAT

IoC_C2Scan

IoC in CSV format with C2 scan over a long period of time

https://github.com/JPCERTCC/GobRAT-Analysis/blob/main/IoC_C2Scan/ioc_c2.csv

C2EmulationTool

C2 emulation tool written by golang that supports analysis of GobRAT malware. For more information, see https://github.com/JPCERTCC/GobRAT-Analysis/tree/main/C2EmulationTool

DecryptTool

IDA Python tool to decrypt GobRAT strings for x86-64

https://github.com/JPCERTCC/GobRAT-Analysis/blob/main/DecryptTool/Decrypt_GobRAT.py

YaraGenerateTool

IDA Python tool for automatic generation of GobRAT yara rules for x86, x86-64, MIPS and ARM

https://github.com/JPCERTCC/GobRAT-Analysis/blob/main/YaraGenerateTool/YaraGene_GobRAT_MultiArch.py

YaraRule

GobRAT yara rule for x86, x86-64, MIPS and ARM

https://github.com/JPCERTCC/GobRAT-Analysis/tree/main/YaraRule

Slide

• AVAR2023
  • https://github.com/JPCERTCC/GobRAT-Analysis/blob/main/Slide/AVAR2023.pdf