Overview
overview
9Static
static
9鑫财手�...pn.exe
windows7-x64
8鑫财手�...pn.exe
windows10-2004-x64
8鑫财手�...ce.dll
windows7-x64
8鑫财手�...ce.dll
windows10-2004-x64
1鑫财手�...xy.dll
windows7-x64
7鑫财手�...xy.dll
windows10-2004-x64
7鑫财手�...00.dll
windows7-x64
1鑫财手�...00.dll
windows10-2004-x64
1鑫财手�...00.dll
windows7-x64
3鑫财手�...00.dll
windows10-2004-x64
3鑫财手�...00.dll
windows7-x64
3鑫财手�...00.dll
windows10-2004-x64
3鑫财手�...er.exe
windows7-x64
8鑫财手�...er.exe
windows10-2004-x64
8鑫财手�...il.dll
windows7-x64
7鑫财手�...il.dll
windows10-2004-x64
7鑫财手�...CN.dll
windows7-x64
1鑫财手�...CN.dll
windows10-2004-x64
1鑫财手�...er.dll
windows7-x64
1鑫财手�...er.dll
windows10-2004-x64
鑫财手�...pi.dll
windows7-x64
1鑫财手�...pi.dll
windows10-2004-x64
1鑫财手�...dc.dll
windows7-x64
8鑫财手�...dc.dll
windows10-2004-x64
8鑫财手�...ce.dll
windows7-x64
1鑫财手�...ce.dll
windows10-2004-x64
1鑫财手�...te.exe
windows7-x64
5鑫财手�...te.exe
windows10-2004-x64
5鑫财手�...��.exe
windows7-x64
8鑫财手�...��.exe
windows10-2004-x64
8Analysis
-
max time network
572s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 23:34
Behavioral task
behavioral1
Sample
鑫财手机协议全能王/91vpn/91vpn.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
鑫财手机协议全能王/91vpn/91vpn.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
鑫财手机协议全能王/91vpn/appface.dll
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
鑫财手机协议全能王/91vpn/appface.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
鑫财手机协议全能王/91vpn/httpproxy.dll
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
鑫财手机协议全能王/91vpn/httpproxy.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
鑫财手机协议全能王/91vpn/mfc100.dll
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
鑫财手机协议全能王/91vpn/mfc100.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
鑫财手机协议全能王/91vpn/msvcp100.dll
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
鑫财手机协议全能王/91vpn/msvcp100.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
鑫财手机协议全能王/91vpn/msvcr100.dll
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
鑫财手机协议全能王/91vpn/msvcr100.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral13
Sample
鑫财手机协议全能王/91vpn/updater.exe
Resource
win7-20220901-en
Behavioral task
behavioral14
Sample
鑫财手机协议全能王/91vpn/updater.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
鑫财手机协议全能王/91vpn/vpnutil.dll
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
鑫财手机协议全能王/91vpn/vpnutil.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
鑫财手机协议全能王/91vpn/zh-CN.dll
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
鑫财手机协议全能王/91vpn/zh-CN.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
鑫财手机协议全能王/UUWiseHelper.dll
Resource
win7-20221111-en
Behavioral task
behavioral20
Sample
鑫财手机协议全能王/UUWiseHelper.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral21
Sample
鑫财手机协议全能王/ZMApi.dll
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
鑫财手机协议全能王/ZMApi.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
鑫财手机协议全能王/dc.dll
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
鑫财手机协议全能王/dc.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
鑫财手机协议全能王/face.dll
Resource
win7-20220901-en
Behavioral task
behavioral26
Sample
鑫财手机协议全能王/face.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
鑫财手机协议全能王/update.exe
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
鑫财手机协议全能王/update.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
鑫财手机协议全能王/鑫财手机协议全能王.exe
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
鑫财手机协议全能王/鑫财手机协议全能王.exe
Resource
win10v2004-20221111-en
Errors
General
-
Target
鑫财手机协议全能王/UUWiseHelper.dll
-
Size
228KB
-
MD5
7c0415db33190179697196004e57d7c4
-
SHA1
08490854f84d7a8034a6945ff146d4862b15b5a7
-
SHA256
aa058b89e25c14072acfac4f9159b7d74b20955e3940088e1037d87ca90d9ec1
-
SHA512
dfd070b4ac5686510251be2564af7cc361246234808b0cb6537ea80e0d3717c061f90c0d4044c7e16d5d875def730ed0ed56ba3d4f7dd580dbdf9e7aab7dd1b7
-
SSDEEP
6144:e+moNhqzesvTmbGvZQZlRrBKvcWJPFOEy5ka0PiRX:EvpwbrBKvtPnyKqX
Malware Config
Signatures
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 162.159.36.2 Destination IP 162.159.36.2