zenconnekt: cd97c264 — Go PE64+ modular RAT, DigiCert-signed, C2 over TLS+WebSocket, "PNG Image File" masquerade

Executive Summary

A 7.8 MB Go 1.x (likely 1.24+) PE32+ x64 binary embedding a modular remote-access agent with WebSocket-over-TLS C2, persistence via scheduled task, Microsoft "PNG Image File" masquerade, and Authenticode signature via DigiCert timestamping. Static-only analysis; capa and floss failed. The "ZENCONNEKT" branding and Go module path core/cmd/agent are hardcoded.

What It Is

• SHA-256: cd97c264b84fbf8a9cd0792fbd4fa71b649e8405c86217f73bdf7590add8336d
• File: 1b2c45ea79435bc4caf03702d4b6af8f.exe ^[metadata.json]
• Type: PE32+ executable (GUI) x86-64, 9 sections ^[file.txt]
• Size: 7,835,936 bytes ^[metadata.json]
• Compiler: Go (gc), amd64/windows, CGO_ENABLED=0, trimpath ^[strings.txt:10]
• Linker: Go linker, MajorLinkerVersion 3.0 ^[pefile.txt:46]
• Signed: Authenticode signed, DigiCert timestamping chain ^[binwalk.txt:17]
• Masquerade: VS_VERSIONINFO claims "Microsoft Corporation", "PNG Image File", wmphoto.exe, "Windows Photo Viewer" ^[pefile.txt:341-351]
• Entropy: main text section .higvud 6.21, .odgax 5.65, .fklx 5.63 ^[pefile.txt:91,111,131]
• Subsystem: Windows GUI ^[rabin2-info.txt:32]
• ASLR+DEP: HIGH_ENTROPY_VA | NX_COMPAT | DYNAMIC_BASE ^[pefile.txt:73]

Build / RE

Toolchain and Language

Go binary built with -buildmode=exe -compiler=gc -trimpath=true, GOARCH=amd64, GOOS=windows, CGO_ENABLED=0, GOAMD64=v1 ^[strings.txt:7893-7899]. The Go build ID is J1mZ9yW6wNInDuSAwQxA/dQ-0N_aUhgWqVDZ951AX/vaVFf4LYF4c-4qvVaJF7/jpW_nOtuQKmQxHHeo6VJ ^[strings.txt:10]. Module path is core/cmd/agent with randomized function name main.agentService ^[strings.txt:5555].

Obfuscation / Anti-Analysis

• No conventional packer (UPX, Themida). Nine sections with random alphanumeric names (.higvud, .odgax, .fklx, .ptbjb, .kshzpp, .crevk, .gdcl, .zjmxru, .hdkbt) — Go compiler behavior under -trimpath when strip-trimpath is active. Not deliberate anti-analysis, but complicates section-based heuristics ^[pefile.txt:78-250].
• Anti-debug / anti-VM process blacklist embedded: x64dbg, x32dbg, windbg, idaq64, pebear, de4dot, regmon, ghidra, cutter, scylla, lordpe, rekal, procmon, procexp, ollydbg, fiddler, fakenet, noriben, regshot, filemon, tcpview, charles, radare2, mitmweb, dbgview, sbiesvc, inetsim, importmon, diskmon ^[strings.txt:7669]
• FIPS 140-only error strings (crypto/rsa: use of keys smaller than 2048 bits is not allowed in FIPS 140-only mode, etc.) indicate targeting FIPS 140-3 compliance — maturity signal, not obfuscation ^[strings.txt:7756].

Embedded Resources

• .rsrc directory contains RT_ICON (0x10828 bytes), RT_GROUP_ICON, and RT_VERSION entries ^[pefile.txt:431-500]. The 68 KB icon resource may carry masquerade imagery.
• No embedded payload blobs or steganographic resources in binwalk beyond Intel microcode false-positives and the DigiCert chain ^[binwalk.txt].

Signing

Authenticode signature at Security directory offset 0x7770B8. DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1 chain confirmed in overlay DER ^[binwalk.txt:17-22]. rabin2 reports signed: true ^[rabin2-info.txt:27]. Leaf certificate CN not recovered from static parse.

Code Quality

Standard Go runtime — HTTP/2 and TLS 1.3 client stack, WebSocket support, msgpack encoding. github.com/creack/pty v1.1.21 and github.com/lxn/win present for pseudo-terminal and Windows API wrappers ^[strings.txt:7890-7891]. No reflective loading or shellcode injection in static strings; process manipulation via Go os/exec and Windows syscall packages.

How It Works

Architecture

Module core/cmd/agent with conventional Go sub-packages:

• core/cmd/agent/wire — dependency injection / service wiring ^[strings.txt:5827]
• core/cmd/agent/config — configuration loading ^[strings.txt:6096]
• core/cmd/agent/protect — self-protection / anti-tamper ^[strings.txt:6236]
• core/cmd/agent/updater — self-update ^[strings.txt:6238]
• core/cmd/agent/capture — screen capture / input logging ^[strings.txt:6284]
• core/cmd/agent/plugins — modular plugin loader ^[strings.txt:6285]
• core/cmd/agent/runtime — runtime detection (shell detection) ^[strings.txt:6286]
• core/cmd/agent/sysinfo — system enumeration ^[strings.txt:6287]
• core/cmd/agent/handlers — C2 command dispatch ^[strings.txt:6377]

Persistence

Scheduled task creation via embedded PowerShell fragment:

$t=New-ScheduledTaskTrigger -AtLogOn;
$s=New-ScheduledTaskSettingsSet -ExecutionTimeLimit 0;

task name ZenconnektAgent-NonInteractive-EncodedCommand under \Microsoft\Windows\ ^[strings.txt:7727,7745]. ATT&CK: T1053.005 (Scheduled Task/Job: Scheduled Task).

C2 Protocol

• Transport: WebSocket over TLS (WSS). URI pattern: %s/api/clients/%s/stream/ws?role=client ^[strings.txt:7724]
• Enrollment: "purgatory" challenge-response with identity fingerprint and signed nonce ^[strings.txt:7700,7720]. Device-fingerprinting handshake.
• Protocol framing: msgpack via github.com/vmihailenco/msgpack/v5 ^[strings.txt:6892]. Control frames: opPing, opPong, dispatcher typed envelopes (dispatcher error: %v (type=%v)) ^[strings.txt:7715].
• HTTP/2 fallback: Go http2 transport present, including SETTINGS, GOAWAY, RST_STREAM, PUSH_PROMISE ^[strings.txt:7695].
• TLS stack: Go crypto/tls with X25519, ML-KEM768, AES-256-GCM, ChaCha20-Poly1305, Ed25519, ECDSA P-256/384/521. TLS 1.3 and EncryptedClientHello supported ^[strings.txt:7756].
• User-Agent: Masquerades as Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 ^[strings.txt:7756].
• Server endpoint: %s/api/agent/latest?platform=%s for update checks ^[strings.txt:7723].

ATT&CK: T1071.001 (Application Layer Protocol: Web Protocols) and T1573 (Encrypted Channel).

Encryption / Obfuscation

• Config encrypted with AES-256-GCM v2: agent-config-aes-256-gcm-v2 ^[strings.txt:7715]
• Config encrypted with XChaCha20-Poly1305 v3: agent-config-xchacha20-poly1305-v3 ^[strings.txt:7727]
• HKDF key derivation: crypto/hkdf ^[strings.txt:6475]
• FIPS 140-3 mode enforcement present.

Evasion / Anti-Sandbox

Process blacklist for 25+ analysis tools ^[strings.txt:7669-7670]. Add-MpPreference -ExclusionProcess — Windows Defender exclusion for own process ^[strings.txt:7695]. ATT&CK: T1562.001 (Impair Defenses: Disable or Modify Tools).

System Interaction

• Clipboard: clipboard: sync, clipboard: set text, clipboard: starting monitor ^[strings.txt:7700,7715]
• Input: mouse_move, mouse_scroll, mouse_down, mouse_up, key_down, key_up, type_char ^[strings.txt:7715,7729,7730]
• Screenshot: [screen] streaming stopped, [screen] capture error ^[strings.txt:7729]
• Desktop remote: [desktop] set resolution, desktop_enable_cursor ^[strings.txt:7715]
• Active window: activewindow: send notification ^[strings.txt:7714]
• Shell: [script_exec] send result error, core/cmd/agent/runtime.detectShell ^[strings.txt:7729,16860]
• Token manipulation: DuplicateTokenEx ^[strings.txt:7695]
• Privilege: AdjustTokenPrivileges, LookupPrivilegeValueW, SetThreadToken ^[strings.txt:7695]

C2 Infrastructure

No hardcoded IP, domain, or URL recovered. Server URLs encrypted at rest: [config] v1 encrypted server URL present but could not decrypt ... falling back to plain URL ^[strings.txt:7756]. Raw server list fetched from runtime-resolved endpoint: Retrying raw server list fetch in %s ^[strings.txt:7741]. Static IOCs: none. All network indicators are runtime-decoded.

Interesting Tidbits

1. Branding: "ZENCONNEKT" is all-caps, appears 11 times. No other language markers; all output English.
2. Build maturity: FIPS 140-3, TLS 1.3+ECH, HTTP/2, WebSocket, msgpack — professional, maintained codebase.
3. No static C2: Config decryption at runtime plus raw server list rotation signals operational discipline.
4. Signed: DigiCert timestamping chain present. Paid or stolen code-signing certificate.
5. Masquerade: VS_VERSIONINFO claims "PNG Image File" / wmphoto.exe. Window title / icon may visually appear as an image viewer.
6. Self-update: agent-update.tmp, [updater] download verified; applying update ^[strings.txt:7695,7741].

Deployable Signatures

YARA Rule

rule zenconnekt_agent {
    meta:
        description = "ZENCONNEKT Go modular RAT — WebSocket C2, persistent task, screenshot/clipboard/input"
        author = "PacketPursuit"
        date = "2026-06-08"
        hash = "cd97c264b84fbf8a9cd0792fbd4fa71b649e8405c86217f73bdf7590add8336d"
    strings:
        $s1  = "ZENCONNEKT_SERVER" ascii wide
        $s2  = "ZENCONNEKT_AGENT_TOKEN" ascii wide
        $s3  = "ZENCONNEKT_MUTEX" ascii wide
        $s4  = "ZENCONNEKT_ENABLE_PERSISTENCE" ascii wide
        $s5  = "ZENCONNEKT_CAPTURE_INTERVAL" ascii wide
        $s6  = "ZENCONNEKT_RECONNECT_DELAY_MS" ascii wide
        $s7  = "core/cmd/agent" ascii wide
        $s8  = "agent-config-aes-256-gcm-v2" ascii wide
        $s9  = "agent-config-xchacha20-poly1305-v3" ascii wide
        $s10 = "[purgatory] identity fingerprint=%s" ascii wide
        $s11 = "[updater] download verified; applying update" ascii wide
        $s12 = "[screen] streaming stopped" ascii wide
        $s13 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" ascii wide
        $s14 = "%s/api/clients/%s/stream/ws?role=client" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        filesize > 5MB and
        filesize < 15MB and
        6 of ($s*) and
        pe.number_of_sections >= 7
}

Behavioral Hunt Query (Sigma-like)

title: ZENCONNEKT Agent Behavioral Fingerprint
logsource:
    product: windows
detection:
    selection_proc:
        - ImageLoaded|endswith:
            - 'ws2_32.dll'
            - 'iphlpapi.dll'
            - 'dnsapi.dll'
        - CommandLine|contains:
            - 'ZENCONNEKT'
            - 'agent-update.tmp'
            - 'Add-MpPreference -ExclusionProcess'
    selection_net:
        - UserAgent|contains: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36'
        - Initiated|endswith: '/stream/ws?role=client'
    selection_persistence:
        EventID: 4698
        TaskContent|contains:
            - 'ZenconnektAgent-NonInteractive-EncodedCommand'
            - 'Windows\\'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: high

IOC List

Behavioral Fingerprint

On first execution, enumerates running processes against a blacklist of 25+ analysis tools (debuggers, disassemblers, network proxies, sandboxes). Establishes TLS 1.3 WebSocket connection to a runtime-decoded C2, presenting a Chrome 131 user-agent. A "purgatory" enrollment handshake exchanges a device identity fingerprint and signed nonce. Post-enrollment, accepts msgpack-framed commands for screen capture, clipboard sync, input injection (mouse/keyboard), file system operations, shell execution, and self-update. Persistence via logon-triggered scheduled task under \Microsoft\Windows\. Supports AES-256-GCM and XChaCha20-Poly1305 encrypted config files. No static C2 addresses embedded; server list fetched from encrypted remote config.

Detection Signatures

References

• SHA-256: cd97c264b84fbf8a9cd0792fbd4fa71b649e8405c86217f73bdf7590add8336d
• MalwareBazaar artifact: a1672e21-d01e-46aa-b629-bcfba435b3e8
• Triage: 2026-05-26, tier "deep" (no family attribution)
• Wiki cross-references: golang-stealer-build-pattern, version-info-masquerade, zenconnekt

Provenance

Static analysis conducted 2026-06-08 using file(1), ExifTool 12.76, python3-pefile, radare2 rabin2, binwalk, GNU strings (19,803 lines), GNU grep. No dynamic execution (CAPE skipped — no Windows guest). Capa failed due to missing signatures; floss failed due to CLI argument error. Binary loaded in radare2 but full analysis timed out at 60s for 7.8 MB Go binary; surface-level strings and structural analysis were sufficient for characterization. All claims cite source file and line number where feasible.