Overview
overview
10Static
static
10客户端(...EY.exe
windows7-x64
9客户端(...EY.exe
windows10-2004-x64
906432
ubuntu-18.04-amd64
91.exe
windows7-x64
1.exe
windows10-2004-x64
518_2.exe
windows7-x64
4518_2.exe
windows10-2004-x64
4520.exe
windows7-x64
4520.exe
windows10-2004-x64
4Drkv
ubuntu-18.04-amd64
9FCK_RSC.dll
windows7-x64
1FCK_RSC.dll
windows10-2004-x64
1FUCK360.exe
windows7-x64
7FUCK360.exe
windows10-2004-x64
10GetPass.exe
windows7-x64
3GetPass.exe
windows10-2004-x64
3HkMh.exe
windows7-x64
10HkMh.exe
windows10-2004-x64
10HkMh_2.exe
windows7-x64
7HkMh_2.exe
windows10-2004-x64
10HkMh_3.exe
windows7-x64
10HkMh_3.exe
windows10-2004-x64
10Killbash.x
ubuntu-18.04-amd64
7ShellCodeDec.exe
windows7-x64
ShellCodeDec.exe
windows10-2004-x64
TSmm
ubuntu-18.04-amd64
1Trustr
ubuntu-18.04-amd64
1UDP.exe
windows7-x64
1UDP.exe
windows10-2004-x64
1a
ubuntu-18.04-amd64
1arm1
debian-9-armhf
1bj.exe
windows7-x64
10Analysis
-
max time kernel
133s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2023 09:33
Behavioral task
behavioral1
Sample
客户端(Client)_KEY.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
客户端(Client)_KEY.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
06432
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral4
Sample
1.exe
Resource
win7-20230220-en
Behavioral task
behavioral5
Sample
1.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
518_2.exe
Resource
win7-20230220-en
Behavioral task
behavioral7
Sample
518_2.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral8
Sample
520.exe
Resource
win7-20230220-en
Behavioral task
behavioral9
Sample
520.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral10
Sample
Drkv
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral11
Sample
FCK_RSC.dll
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
FCK_RSC.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
FUCK360.exe
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
FUCK360.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
GetPass.exe
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
GetPass.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
HkMh.exe
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
HkMh.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
HkMh_2.exe
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
HkMh_2.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
HkMh_3.exe
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
HkMh_3.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral23
Sample
Killbash.x
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral24
Sample
ShellCodeDec.exe
Resource
win7-20230220-en
Behavioral task
behavioral25
Sample
ShellCodeDec.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral26
Sample
TSmm
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral27
Sample
Trustr
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral28
Sample
UDP.exe
Resource
win7-20230220-en
Behavioral task
behavioral29
Sample
UDP.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral30
Sample
a
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral31
Sample
arm1
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral32
Sample
bj.exe
Resource
win7-20230220-en
General
-
Target
518_2.exe
-
Size
68KB
-
MD5
4ad86e5001f11f30b6f67344c325609f
-
SHA1
4bcd6382f5d095f271f81f235d0285305a48ab02
-
SHA256
aec671efacaa95db6e4487bc2914038f80939be5889d4b313aa137ac1ca91549
-
SHA512
bbf47ebacc510575081296d8160ae8e62e9619f56192c80f9d52a38f607cfa19027cfb04e507fc263b44f77135f32454ea1da0af4cd8046ccd6dcdca2ffef434
-
SSDEEP
768:EkHn8ozagGwcfAXZq6Imvy0D6SbUtOpgAq0:E8n7Gw5p1IqrAtOp3f
Malware Config
Signatures
-
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\AppPatch\NetSyst76.dll 518_2.exe