Overview
overview
10Static
static
8kjfsbdqc/�...er.exe
windows7-x64
8kjfsbdqc/�...er.exe
windows10-2004-x64
8kjfsbdqc/�...��.url
windows7-x64
1kjfsbdqc/�...��.url
windows10-2004-x64
1kjfsbdqc/�...��.exe
windows7-x64
8kjfsbdqc/�...��.exe
windows10-2004-x64
8kjfsbdqc/�...��.vbs
windows7-x64
10kjfsbdqc/�...��.vbs
windows10-2004-x64
10Behavioral task
behavioral1
Sample
kjfsbdqc/恢复文件夹隐藏属性工具/kill_folder.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
kjfsbdqc/恢复文件夹隐藏属性工具/kill_folder.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
kjfsbdqc/比克尔.url
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
kjfsbdqc/比克尔.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
kjfsbdqc/清理工具/清理工具.exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
kjfsbdqc/清理工具/清理工具.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
kjfsbdqc/自动化清除脚本/自动化清除脚本.vbs
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
kjfsbdqc/自动化清除脚本/自动化清除脚本.vbs
Resource
win10v2004-20220812-en
General
-
Target
098912e1f06202347dd808390ddcfaf5c25d47129ed0594fddce0e8308b4982f
-
Size
557KB
-
MD5
0405dffee9469b0ba5ecb2b4da286a86
-
SHA1
cee02bf51f1d6f9cfba2bc3ce01f42704fd7e76c
-
SHA256
098912e1f06202347dd808390ddcfaf5c25d47129ed0594fddce0e8308b4982f
-
SHA512
bf5a1b9bf52f38d626ee0ae1a699e6d0b2b6b7da487f747787853c27b083ec49f2710b720371c60ab289b62308ef7293edbb82c85a472b3f72307d5a41d84c4d
-
SSDEEP
12288:TVYe95Aeqi4kPskg+iYk9n9iJx1OioYOpn+vmNZmOP:TuG5Aa4ks3xiJx1RwGmrmOP
Malware Config
Signatures
-
resource yara_rule static1/unpack001/kjfsbdqc/恢复文件夹隐藏属性工具/kill_folder.exe upx static1/unpack001/kjfsbdqc/清理工具/清理工具.exe upx
Files
-
098912e1f06202347dd808390ddcfaf5c25d47129ed0594fddce0e8308b4982f.zip
-
kjfsbdqc/恢复文件夹隐藏属性工具/kill_folder.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 888KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 374KB - Virtual size: 376KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 114KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.text Size: 640KB - Virtual size: 639KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 20KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 60B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 506KB - Virtual size: 506KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
kjfsbdqc/恢复文件夹隐藏属性工具/操作说明.JPG.jpg
-
kjfsbdqc/恢复文件夹隐藏属性工具/说明.txt
-
kjfsbdqc/比克尔.url.url
-
kjfsbdqc/清理工具/LogAction.dat
-
kjfsbdqc/清理工具/操作说明.JPG.jpg
-
kjfsbdqc/清理工具/清理工具.exe.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 184KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 27KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 60KB - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 108KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
kjfsbdqc/清理工具/说明.txt
-
kjfsbdqc/自动化清除脚本/自动化清除脚本.vbs.vbs
-
kjfsbdqc/自动化清除脚本/说明.txt
-
kjfsbdqc/附件说明.txt