Overview
overview
10Static
static
10客户端(...EY.exe
windows7-x64
9客户端(...EY.exe
windows10-2004-x64
906432
ubuntu-18.04-amd64
91.exe
windows7-x64
1.exe
windows10-2004-x64
518_2.exe
windows7-x64
4518_2.exe
windows10-2004-x64
4520.exe
windows7-x64
4520.exe
windows10-2004-x64
4Drkv
ubuntu-18.04-amd64
9FCK_RSC.dll
windows7-x64
1FCK_RSC.dll
windows10-2004-x64
1FUCK360.exe
windows7-x64
7FUCK360.exe
windows10-2004-x64
10GetPass.exe
windows7-x64
3GetPass.exe
windows10-2004-x64
3HkMh.exe
windows7-x64
10HkMh.exe
windows10-2004-x64
10HkMh_2.exe
windows7-x64
7HkMh_2.exe
windows10-2004-x64
10HkMh_3.exe
windows7-x64
10HkMh_3.exe
windows10-2004-x64
10Killbash.x
ubuntu-18.04-amd64
7ShellCodeDec.exe
windows7-x64
ShellCodeDec.exe
windows10-2004-x64
TSmm
ubuntu-18.04-amd64
1Trustr
ubuntu-18.04-amd64
1UDP.exe
windows7-x64
1UDP.exe
windows10-2004-x64
1a
ubuntu-18.04-amd64
1arm1
debian-9-armhf
1bj.exe
windows7-x64
10Analysis
-
max time kernel
154s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
27-03-2023 09:33
Behavioral task
behavioral1
Sample
客户端(Client)_KEY.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
客户端(Client)_KEY.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
06432
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral4
Sample
1.exe
Resource
win7-20230220-en
Behavioral task
behavioral5
Sample
1.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
518_2.exe
Resource
win7-20230220-en
Behavioral task
behavioral7
Sample
518_2.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral8
Sample
520.exe
Resource
win7-20230220-en
Behavioral task
behavioral9
Sample
520.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral10
Sample
Drkv
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral11
Sample
FCK_RSC.dll
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
FCK_RSC.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
FUCK360.exe
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
FUCK360.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
GetPass.exe
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
GetPass.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
HkMh.exe
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
HkMh.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
HkMh_2.exe
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
HkMh_2.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
HkMh_3.exe
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
HkMh_3.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral23
Sample
Killbash.x
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral24
Sample
ShellCodeDec.exe
Resource
win7-20230220-en
Behavioral task
behavioral25
Sample
ShellCodeDec.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral26
Sample
TSmm
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral27
Sample
Trustr
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral28
Sample
UDP.exe
Resource
win7-20230220-en
Behavioral task
behavioral29
Sample
UDP.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral30
Sample
a
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral31
Sample
arm1
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral32
Sample
bj.exe
Resource
win7-20230220-en
General
-
Target
520.exe
-
Size
29KB
-
MD5
4757d1138e38d916bad87bfa92cf90c9
-
SHA1
06d7fd312e50eb34512c5e9ac7eea29f76c8e667
-
SHA256
0f254db8f98e6626c487e0bb534b27f33fce6c280ce77303ad356f8c1ce01e11
-
SHA512
002382b2b860657b17b15b194b160d4e6dc880ef068ac9a5733617a960e7da8afe9d33e5efe520ab0361ae2b014e049cfab1006e96ac65759c29aeec66548e86
-
SSDEEP
384:wVQPhCc4EMap5JN1VY8ianYPLI46OXBc1yoMOmFi6j:kQ50EMaX9V3ianaXBc1f3mb
Malware Config
Signatures
-
Drops file in Program Files directory 1 IoCs
Processes:
520.exedescription ioc process File created C:\Program Files\AppPatch\NetSyst76.dll 520.exe