Go-Built RAT with RequestBin DNS Callbacks and Long-Sleep Evasion


Zero‑Dwell Threat Intelligence Report

A narrative, executive‑ready view into the malware’s behavior, exposure, and reliable defenses.
Generated: 2025-11-11 23:06:01 UTC

Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

File
5y32o6b0.exe
Type
PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
SHA‑1
d2d49edef0b0ec703471ae5aac0cbe34f6653cb0
MD5
a42893bd453b05d83a20dfea1e15de38
First Seen
2025-10-06 05:59:29.996887
Last Analysis
2025-10-06 07:52:49.863006
Dwell Time
0 days, 7 hours, 33 minutes

Extended Dwell Time Impact

For 1+ hours, this malware remained undetected — a limited but sufficient window for the adversary to complete initial execution and establish basic system access.

Comparative Context

Industry studies report a median dwell time closer to 21–24 days. This case represents rapid detection and containment within hours rather than days.

Timeline

Time (UTC) Event Elapsed
2025-10-05 01:24:49 UTC First VirusTotal submission —
2025-10-08 14:28:18 UTC Latest analysis snapshot 3 days, 13 hours, 3 minutes
2025-11-11 23:06:01 UTC Report generation time 31 days, 5 hours, 48 minutes

Why It Matters

Every additional day of dwell time is not just an abstract number — it is attacker opportunity. Each day equates to more time for lateral movement, stealth persistence, and intelligence gathering.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 72. Detected as malicious: 60. Missed: 12. Coverage: 83.3%.

Detected Vendors

  • Xcitium
  • +59 additional vendors (names not provided)

List includes Xcitium plus an additional 59 vendors per the provided summary.

Missed Vendors

  • Acronis
  • Baidu
  • CMC
  • MaxSecure
  • Paloalto
  • SUPERAntiSpyware
  • TACHYON
  • Trapmine
  • TrendMicro
  • ViRobot
  • Webroot
  • Zoner

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

Behavioral Storyline — How the Malware Operates

Dominant system-level operations (83.57% of behavior) suggest this malware performs deep system reconnaissance, privilege escalation, or core OS manipulation. It’s actively probing system defenses and attempting to gain administrative control.

Behavior Categories (weighted)

Weight values represent the frequency and intensity of malware interactions with specific system components. Higher weights indicate more aggressive targeting of that category. Each operation (registry access, file modification, network connection, etc.) contributes to the category’s total weight, providing a quantitative measure of the malware’s behavioral focus.

Category Weight Percentage
System 173 83.57%
File System 14 6.76%
Process 8 3.86%
Network 5 2.42%
Threading 3 1.45%
Registry 2 0.97%
Misc 1 0.48%
Device 1 0.48%

MITRE ATT&CK Mapping

  • T1497.001 – reference anti-VM strings targeting Qemu
  • T1027 – encrypt data using DES
  • T1027 – encode data using Base64
  • T1027 – reference Base64 string
  • T1497.001 – reference anti-VM strings targeting VirtualBox
  • T1113 – capture screenshot in Go
  • T1027 – encrypt data using AES via x86 extensions
  • T1497.001 – reference anti-VM strings targeting VMWare
  • T1129 – access PEB ldr_data
  • T1497.001 – reference anti-VM strings
  • T1027 – encode data using XOR
  • T1027 – encrypt data using RC4 PRGA
  • T1497.001 – reference anti-VM strings targeting Parallels
  • T1497.001 – reference anti-VM strings targeting VirtualPC

Following the Trail — Network & DNS Activity

Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.

Contacted Domains

Domain IP Country ASN/Org
— 198.51.100.1 — —
www.aieov.com 76.223.54.146 United States Amazon.com, Inc.

Observed IPs

IP Country ASN/Org
224.0.0.252 — —
8.8.4.4 United States Google LLC
8.8.8.8 United States Google LLC

DNS Queries

Request Type
5isohu.com A
ent34ndx3cz8k.x.pipedream.net A
pvqKHzyxyFST.b17da333ec194ec4b767.d.requestbin.net A
www.aieov.com A
BnzYYNnf.b17da333ec194ec4b767.d.requestbin.net A
GftgwmxypygKD.b17da333ec194ec4b767.d.requestbin.net A
oCTZa.b17da333ec194ec4b767.d.requestbin.net A

Contacted IPs

IP Country ASN/Org
224.0.0.252 — —
8.8.4.4 United States Google LLC
8.8.8.8 United States Google LLC

Port Distribution

Port Count Protocols
137 1 udp
138 1 udp
5355 3 udp
53 18 udp

UDP Packets

Source IP Dest IP Sport Dport Time Proto
192.168.56.14 192.168.56.255 137 137 6.884530067443848 udp
192.168.56.14 192.168.56.255 138 138 12.884318113327026 udp
192.168.56.14 224.0.0.252 51209 5355 6.81559419631958 udp
192.168.56.14 224.0.0.252 52815 5355 9.416317224502563 udp
192.168.56.14 224.0.0.252 55848 5355 6.863170146942139 udp
192.168.56.14 8.8.4.4 49916 53 54.97763919830322 udp
192.168.56.14 8.8.4.4 50710 53 36.7283251285553 udp
192.168.56.14 8.8.4.4 53401 53 7.009526014328003 udp
192.168.56.14 8.8.4.4 54579 53 32.69666504859924 udp
192.168.56.14 8.8.4.4 55094 53 7.704394102096558 udp
192.168.56.14 8.8.4.4 60117 53 44.696773052215576 udp
192.168.56.14 8.8.4.4 62112 53 21.369174003601074 udp
192.168.56.14 8.8.4.4 64753 53 56.69685411453247 udp
192.168.56.14 8.8.4.4 65148 53 19.69744110107422 udp
192.168.56.14 8.8.8.8 49916 53 53.97893309593201 udp
192.168.56.14 8.8.8.8 50710 53 35.72873020172119 udp
192.168.56.14 8.8.8.8 53401 53 8.011128187179565 udp
192.168.56.14 8.8.8.8 54579 53 31.697370052337646 udp
192.168.56.14 8.8.8.8 55094 53 8.696556091308594 udp
192.168.56.14 8.8.8.8 60117 53 43.697092056274414 udp
192.168.56.14 8.8.8.8 62112 53 22.36850619316101 udp
192.168.56.14 8.8.8.8 64753 53 55.696991205215454 udp
192.168.56.14 8.8.8.8 65148 53 20.69659399986267 udp

Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.

Persistence & Policy — Registry and Services

Registry and service telemetry points to policy awareness and environment reconnaissance rather than noisy persistence. Below is a compact view of the most relevant keys and handles; expand to see the full lists where available.

Registry Opened

0

Registry Set

2

Services Started

0

Services Opened

0

Registry Opened (Top 25)

Show all (297 total)

Registry Set (Top 25)

Key Value
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ToLz %windir%\System32\ToLz.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\x %windir%\System32\x.exe

Services Started (Top 15)

Services Opened (Top 15)

What To Do Now — Practical Defense Playbook

  • Contain unknowns: block first‑run binaries by default — signatures catch up, containment works now.
  • EDR controls: alert on keyboard hooks, screen capture APIs, VM/sandbox checks, and command‑shell launches.
  • Registry watch: flag queries/sets under policy paths (e.g., …\FipsAlgorithmPolicy\*).
  • Network rules: inspect outbound TLS to IP‑lookup services and unexpected CDN endpoints.
  • Hunt broadly: sweep endpoints for the indicators above and quarantine positives immediately.

Dwell time equals attacker opportunity. Reducing execution privileges and egress shrinks that window even when vendors disagree.

Scroll to Top