Overview
overview
10Static
static
10客户端(...EY.exe
windows7-x64
9客户端(...EY.exe
windows10-2004-x64
906432
ubuntu-18.04-amd64
91.exe
windows7-x64
1.exe
windows10-2004-x64
518_2.exe
windows7-x64
4518_2.exe
windows10-2004-x64
4520.exe
windows7-x64
4520.exe
windows10-2004-x64
4Drkv
ubuntu-18.04-amd64
9FCK_RSC.dll
windows7-x64
1FCK_RSC.dll
windows10-2004-x64
1FUCK360.exe
windows7-x64
7FUCK360.exe
windows10-2004-x64
10GetPass.exe
windows7-x64
3GetPass.exe
windows10-2004-x64
3HkMh.exe
windows7-x64
10HkMh.exe
windows10-2004-x64
10HkMh_2.exe
windows7-x64
7HkMh_2.exe
windows10-2004-x64
10HkMh_3.exe
windows7-x64
10HkMh_3.exe
windows10-2004-x64
10Killbash.x
ubuntu-18.04-amd64
7ShellCodeDec.exe
windows7-x64
ShellCodeDec.exe
windows10-2004-x64
TSmm
ubuntu-18.04-amd64
1Trustr
ubuntu-18.04-amd64
1UDP.exe
windows7-x64
1UDP.exe
windows10-2004-x64
1a
ubuntu-18.04-amd64
1arm1
debian-9-armhf
1bj.exe
windows7-x64
10Analysis
-
max time kernel
81s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2023 09:33
Behavioral task
behavioral1
Sample
客户端(Client)_KEY.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
客户端(Client)_KEY.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
06432
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral4
Sample
1.exe
Resource
win7-20230220-en
Behavioral task
behavioral5
Sample
1.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
518_2.exe
Resource
win7-20230220-en
Behavioral task
behavioral7
Sample
518_2.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral8
Sample
520.exe
Resource
win7-20230220-en
Behavioral task
behavioral9
Sample
520.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral10
Sample
Drkv
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral11
Sample
FCK_RSC.dll
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
FCK_RSC.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
FUCK360.exe
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
FUCK360.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
GetPass.exe
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
GetPass.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
HkMh.exe
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
HkMh.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
HkMh_2.exe
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
HkMh_2.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
HkMh_3.exe
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
HkMh_3.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral23
Sample
Killbash.x
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral24
Sample
ShellCodeDec.exe
Resource
win7-20230220-en
Behavioral task
behavioral25
Sample
ShellCodeDec.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral26
Sample
TSmm
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral27
Sample
Trustr
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral28
Sample
UDP.exe
Resource
win7-20230220-en
Behavioral task
behavioral29
Sample
UDP.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral30
Sample
a
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral31
Sample
arm1
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral32
Sample
bj.exe
Resource
win7-20230220-en
General
-
Target
UDP.exe
-
Size
31KB
-
MD5
161f6beec09cd33d710f8f97365ee6f6
-
SHA1
9c408d1b53a1d03e8c7a3f85e050870f3d9a741f
-
SHA256
f73a89b6a5c42d21ee4f7a4d79ad784cdfd896bbe2453b60cf9688786f7a9d98
-
SHA512
e9f2afd6ad8216fa0f34cca29ba4d8753a03b187f4e9c29a0607e9b2ad932b788cb9a75db54df0db522e2a20d54a12992ed2396f40f06ab8cd76a89bcbf1e6be
-
SSDEEP
384:+ubvs5ed2wcTZr5bDDOp61lpHwdkJAqJDPHYM:hshb9r5b3Op8lVbJTJwM
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
UDP.exepid process 4552 UDP.exe 4552 UDP.exe