ZENCONNEKT

A Go-based modular remote-access trojan (RAT) family branding itself with the hardcoded string "ZENCONNEKT". Observed as a 7.8 MB PE32+ x64 binary with Authenticode signing, WebSocket-over-TLS C2, and plugin-based architecture. Shares Go build traits with the broader infostealer/RAT cluster (trimpath, CGO_ENABLED=0, randomized main-package names).

Build Stack

• Language: Go (gc), CGO_ENABLED=0, trimpath
• Arch: amd64 / windows, GOAMD64=v1
• Module: core/cmd/agent with randomized function name main.agentService
• Signing: Authenticode with DigiCert timestamping chain
• Masquerade: Varies per sample; observed as "Microsoft Corporation / PNG Image File / Windows Photo Viewer"

Deploy / TTPs

• Persistence via scheduled task (logon trigger, \Microsoft\Windows\ path)
• Windows Defender exclusion (Add-MpPreference -ExclusionProcess)
• WebSocket C2 over TLS 1.3 with "purgatory" enrollment handshake
• msgpack-framed command dispatch
• Encrypted config: AES-256-GCM v2 and XChaCha20-Poly1305 v3
• Self-update via HTTPS download-and-verify
• Process blacklist for analysis tools (debuggers, sandboxes, proxies)
• Screen capture, clipboard sync, mouse/keyboard input injection
• Shell execution with result reporting
• Desktop remote control (resolution, cursor)

Capabilities

• websocket-tls-c2-enrollment
• msgpack-command-dispatch
• scheduled-task-persistence
• defender-exclusion-process
• config-aes256gcm-v2
• config-xchacha20poly1305-v3
• self-update-verified-download
• screenshot-capture
• clipboard-sync
• input-injection-mouse-keyboard
• process-blacklist-anti-debug
• token-impersonation-duplicatetokenex
• shell-exec-result-report
• desktop-remote-control
• tls13-ech-support
• go-trimpath-build

Notable Analyses

• cd97c264 — Static deep-dive

Related

• golang-stealer-build-pattern — shared Go build artifacts
• version-info-masquerade — VS_VERSIONINFO masquerade technique