Trojan:Win32/GoRat.DA!MTB - ThreatCheck.sh

user@threatcheck.sh ~ threat-analysis

bash

$ analyze-threat Trojan:Win32/GoRat.DA!MTB

Trojan:Win32/GoRat.DA!MTB - Windows Defender threat signature analysis

$ cat analysis.txt

=== THREAT ANALYSIS REPORT ===

Threat Name: Trojan:Win32/GoRat.DA!MTB

Classification:

Type:Trojan

Platform:Win32

Family:GoRat

Detection Type:Concrete

Known malware family with identified signatures

Variant:DA

Specific signature variant within the malware family

Suffix:!MTB

Detected via machine learning and behavioral analysis

Detection Method:Behavioral

Confidence:Very High

False-Positive Risk:Low

Concrete signature match: Trojan - Appears legitimate but performs malicious actions for 32-bit Windows platform, family GoRat

Summary:

This is a concrete detection of Trojan:Win32/GoRat.DA, a sophisticated Remote Access Trojan (RAT) variant identified with low false positive risk. It leverages machine learning behavioral analysis and is capable of extensive system control, including taking screenshots, gathering system information, locking the workstation, terminating processes, exfiltrating files, and initiating system shutdown.

Severity:

Critical

VDM Static Detection:

Relevant strings associated with this threat:
 - Spark/client/core.screenshot (PEHSTR_EXT)
 - Spark/client/core.GetMacAddress (PEHSTR_EXT)
 - Spark/client/core.GetCPUInfo (PEHSTR_EXT)
 - Spark/client/core.GetRAMInfo (PEHSTR_EXT)
 - Spark/client/core.lock (PEHSTR_EXT)
 - Spark/client/core.killTerminal (PEHSTR_EXT)
 - Spark/client/core.uploadFiles (PEHSTR_EXT)
 - Spark/client/core.killProcess (PEHSTR_EXT)
 - Spark/client/core.shutdown (PEHSTR_EXT)

YARA Rule:

rule Trojan_Win32_GoRat_DA_2147844252_0
{
    meta:
        author = "threatcheck.sh"
        detection_name = "Trojan:Win32/GoRat.DA!MTB"
        threat_id = "2147844252"
        type = "Trojan"
        platform = "Win32: Windows 32-bit platform"
        family = "GoRat"
        severity = "Critical"
        info = "MTB: Microsoft Threat Behavior"
        signature_type = "SIGNATURE_TYPE_PEHSTR_EXT"
        threshold = "10"
        strings_accuracy = "High"
    strings:
        $x_1_1 = "Go build ID:" ascii //weight: 1
        $x_1_2 = "Spark/client/core.screenshot" ascii //weight: 1
        $x_1_3 = "Spark/client/core.GetMacAddress" ascii //weight: 1
        $x_1_4 = "Spark/client/core.GetCPUInfo" ascii //weight: 1
        $x_1_5 = "Spark/client/core.GetRAMInfo" ascii //weight: 1
        $x_1_6 = "Spark/client/core.lock" ascii //weight: 1
        $x_1_7 = "Spark/client/core.killTerminal" ascii //weight: 1
        $x_1_8 = "Spark/client/core.uploadFiles" ascii //weight: 1
        $x_1_9 = "Spark/client/core.killProcess" ascii //weight: 1
        $x_1_10 = "Spark/client/core.shutdown" ascii //weight: 1
    condition:
        (filesize < 20MB) and
        (all of ($x*))
}

Known malware which is associated with this threat:

Filename: Update.exe

10fca076384a292f5e79bb6b92dbaefbf63ad025d5dae392007a993fb5391fca

06/01/2026

→VirusTotal ↓Download Sample

Remediation Steps:

Immediately isolate the affected system from the network, perform a full system scan with updated anti-malware software to remove all malicious components, and investigate for potential data exfiltration or lateral movement. Reset any compromised credentials and ensure all systems are patched and updated.

=== END REPORT ===

$ reanalyze-threat

This analysis was last updated on 06/01/2026. Do you want to analyze it again?

$ ls available-commands/

→ cd /home

user@threatcheck.sh:~$ ▊

Trojan:Win32/GoRat.DA!MTB - Windows Defender Threat Analysis