Overview
overview
3Static
static
1ershou/GONGGAO.vbs
windows7-x64
1ershou/GONGGAO.vbs
windows10-2004-x64
1ershou/TIME.asp
windows7-x64
3ershou/TIME.asp
windows10-2004-x64
1ershou/addxinxi.vbs
windows7-x64
1ershou/addxinxi.vbs
windows10-2004-x64
1ershou/add...hk.vbs
windows7-x64
1ershou/add...hk.vbs
windows10-2004-x64
1ershou/adm...UK.vbs
windows7-x64
1ershou/adm...UK.vbs
windows10-2004-x64
1ershou/adm...er.asp
windows7-x64
3ershou/adm...er.asp
windows10-2004-x64
3ershou/adm...hk.vbs
windows7-x64
1ershou/adm...hk.vbs
windows10-2004-x64
1ershou/adm...ao.asp
windows7-x64
3ershou/adm...ao.asp
windows10-2004-x64
3ershou/adm...hk.vbs
windows7-x64
1ershou/adm...hk.vbs
windows10-2004-x64
1ershou/adm...dd.vbs
windows7-x64
1ershou/adm...dd.vbs
windows10-2004-x64
1ershou/adm...hk.vbs
windows7-x64
1ershou/adm...hk.vbs
windows10-2004-x64
1ershou/adm...hk.vbs
windows7-x64
1ershou/adm...hk.vbs
windows10-2004-x64
1ershou/adm...in.asp
windows7-x64
3ershou/adm...in.asp
windows10-2004-x64
3ershou/adm...in.asp
windows7-x64
3ershou/adm...in.asp
windows10-2004-x64
3ershou/adm...ut.asp
windows7-x64
3ershou/adm...ut.asp
windows10-2004-x64
3ershou/adm...il.asp
windows7-x64
3ershou/adm...il.asp
windows10-2004-x64
3Static task
static1
Behavioral task
behavioral1
Sample
ershou/GONGGAO.vbs
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ershou/GONGGAO.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
ershou/TIME.asp
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
ershou/TIME.asp
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
ershou/addxinxi.vbs
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
ershou/addxinxi.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
ershou/addxinxichk.vbs
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
ershou/addxinxichk.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
ershou/admin/DEL_BUK.vbs
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
ershou/admin/DEL_BUK.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
ershou/admin/add_user.asp
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
ershou/admin/add_user.asp
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
ershou/admin/add_userchk.vbs
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
ershou/admin/add_userchk.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
ershou/admin/addgonggao.asp
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
ershou/admin/addgonggao.asp
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
ershou/admin/addgonggaochk.vbs
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
ershou/admin/addgonggaochk.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
ershou/admin/admin_add.vbs
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
ershou/admin/admin_add.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
ershou/admin/admin_addchk.vbs
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
ershou/admin/admin_addchk.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
ershou/admin/admin_chk.vbs
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
ershou/admin/admin_chk.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
ershou/admin/admin_chklogin.asp
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
ershou/admin/admin_chklogin.asp
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
ershou/admin/admin_login.asp
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
ershou/admin/admin_login.asp
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
ershou/admin/admin_logout.asp
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
ershou/admin/admin_logout.asp
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
ershou/admin/adminmail.asp
Resource
win7-20231215-en
Behavioral task
behavioral32
Sample
ershou/admin/adminmail.asp
Resource
win10v2004-20231215-en
General
-
Target
08aabc27e1afc82bc3f05d7c4a16e776
-
Size
191KB
-
MD5
08aabc27e1afc82bc3f05d7c4a16e776
-
SHA1
8b107a4b88497a26bfb02ece70608f7c013d877a
-
SHA256
75330ae8bd933f9616cdd55c2c583853939d0e9db84ec941e99ebf1f09142b7b
-
SHA512
c3cc98783a353948913bf258fbd87a5cfe3a1844a29a6f30f22c6c0f9109b4bae3b6a80a5093b6c5ac17f9b6f3fa767e1220ad1f4f10e31d45338fabab5a1193
-
SSDEEP
3072:hmtUYbp7NBL7WUWgf+TpKtkEV2JWOtrR9fj4haCTzrLq5Gop7nrtOI/BqQPc1SKY:0tUeL71WgWTS2JWQNl7Cn/eFnySKY
Malware Config
Signatures
Files
-
08aabc27e1afc82bc3f05d7c4a16e776.rar
-
ershou/1.CSS
-
ershou/2.css
-
ershou/GONGGAO.ASP.vbs
-
ershou/TIME.ASP
-
ershou/addxinxi.asp.vbs
-
ershou/addxinxichk.asp.vbs
-
ershou/admin/DEL_BUK.ASP.vbs
-
ershou/admin/add_user.asp
-
ershou/admin/add_userchk.asp.vbs
-
ershou/admin/addgonggao.asp
-
ershou/admin/addgonggaochk.asp.vbs
-
ershou/admin/admin_add.asp.vbs
-
ershou/admin/admin_addchk.asp.vbs
-
ershou/admin/admin_chk.asp.vbs
-
ershou/admin/admin_chklogin.asp.asp .vbs polyglot
-
ershou/admin/admin_login.asp.asp
-
ershou/admin/admin_logout.asp.asp
-
ershou/admin/adminmail.asp
-
ershou/admin/adminmailchk.asp.vbs
-
ershou/admin/admintitle.asp.vbs
-
ershou/admin/admintitlechk.asp.vbs
-
ershou/admin/admsgl.asp.vbs
-
ershou/admin/beifendata.asp.vbs
-
ershou/admin/checkcode.asp.vbs
-
ershou/admin/conn.asp.asp .vbs polyglot
-
ershou/admin/cookies.asp.vbs
-
ershou/admin/delgonggao.asp.vbs
-
ershou/admin/delhf.asp.vbs
-
ershou/admin/deluser.asp.vbs
-
ershou/admin/delxinxi.asp.vbs
-
ershou/admin/editgonggao.asp.vbs
-
ershou/admin/editxinxi.asp.vbs
-
ershou/admin/fenlei.asp.vbs
-
ershou/admin/fenlei_2.asp.vbs
-
ershou/admin/fenlei_2chk.asp.vbs
-
ershou/admin/fenlei_2edit.asp.vbs
-
ershou/admin/fenlei_2editchk.asp.vbs
-
ershou/admin/fenlei_2editdel.asp.vbs
-
ershou/admin/fenlei_html.asp.vbs
-
ershou/admin/fenleiedit.asp.vbs
-
ershou/admin/gbook.asp.js
-
ershou/admin/gbookdel.asp.vbs
-
ershou/admin/gbookedit.asp.vbs
-
ershou/admin/gbookhf.asp.vbs
-
ershou/admin/img/bg.gif.gif
-
ershou/admin/img/ershou_1.gif.gif
-
ershou/admin/img/ershou_2.gif.gif
-
ershou/admin/img/left_form_r1_c1.gif.gif
-
ershou/admin/img/left_form_r2_c1.gif.gif
-
ershou/admin/img/left_form_r4_c1.gif.gif
-
ershou/admin/img/r3.gif.gif
-
ershou/admin/index.asp
-
ershou/admin/left.asp
-
ershou/admin/link.asp.vbs
-
ershou/admin/linkchk.asp.vbs
-
ershou/admin/list_buk.asp.vbs
-
ershou/admin/listgonggao.asp.vbs
-
ershou/admin/login.asp
-
ershou/admin/loginchk.asp.vbs
-
ershou/admin/md5.asp.vbs
-
ershou/admin/out.asp
-
ershou/admin/right.asp.vbs
-
ershou/admin/user_del.asp.vbs
-
ershou/admin/user_editdj.asp.vbs
-
ershou/admin/user_editdjchk.asp.vbs
-
ershou/admin/user_edithb.asp.vbs
-
ershou/admin/user_edithbchk.asp.vbs
-
ershou/admin/user_editmail.asp.vbs
-
ershou/admin/user_editmailchk.asp.vbs
-
ershou/admin/user_editpass.asp.vbs
-
ershou/admin/user_editpasschk.asp.vbs
-
ershou/admin/user_editzj.asp.vbs
-
ershou/admin/user_editzjchk.asp.vbs
-
ershou/admin/user_gl.asp.vbs
-
ershou/admin/user_pass.asp
-
ershou/admin/user_passchk.asp.vbs
-
ershou/admin/userlist.asp.vbs
-
ershou/admin/xinxi.asp.vbs
-
ershou/admin/xinxi1.asp.vbs
-
ershou/admin/xinxi_del.asp.vbs
-
ershou/admin/xinxi_del1.asp.vbs
-
ershou/admin/xinxi_edit.asp.vbs
-
ershou/admin/xinxi_edit1.asp.vbs
-
ershou/admin/xinxi_editchk.asp.vbs
-
ershou/admin/xinxi_editchk1.asp.vbs
-
ershou/admin/xinxi_hf.asp.vbs
-
ershou/admin/xinxi_hfdel.asp.vbs
-
ershou/admin/xinxi_mail.asp.vbs
-
ershou/admin/xinxi_tj.asp.vbs
-
ershou/admin/xinxi_tjchk.asp.vbs
-
ershou/admin/xinxi_yz.asp.vbs
-
ershou/admin/xinximail.asp.vbs
-
ershou/admin/xinximail1.asp.vbs
-
ershou/admin/xinximailchk.asp.vbs
-
ershou/c.asp.vbs
-
ershou/classlist.asp.vbs
-
ershou/config.asp
-
ershou/conn.asp.asp .vbs polyglot
-
ershou/copywright.asp.html
-
ershou/data/ijob.mdb
-
ershou/djzh.asp.vbs
-
ershou/djzhchk.asp.vbs
-
ershou/edit_xinxi.asp.vbs
-
ershou/edit_xinxi_a.asp.vbs
-
ershou/edit_xinxi_b.asp.vbs
-
ershou/edit_xinxi_c.asp.vbs
-
ershou/edit_xinxi_d.asp.vbs
-
ershou/edit_xinxichk.asp.vbs
-
ershou/err.asp.vbs
-
ershou/fagui.asp
-
ershou/fenlei.html
-
ershou/fenlei_1.html
-
ershou/forget.asp
-
ershou/forget1.asp.js
-
ershou/forget2.asp.vbs
-
ershou/gbook.asp.vbs
-
ershou/gbookchk.asp.vbs
-
ershou/gmhb.asp.vbs
-
ershou/help.asp
-
ershou/ijob.inc.html .vbs polyglot
-
ershou/images/_more.gif.gif
-
ershou/images/bookmark.gif.gif
-
ershou/images/folder.gif.gif
-
ershou/images/num/0.gif.gif
-
ershou/images/num/1.gif.gif
-
ershou/images/num/2.gif.gif
-
ershou/images/num/3.gif.gif
-
ershou/images/num/4.gif.gif
-
ershou/images/num/5.gif.gif
-
ershou/images/num/6.gif.gif
-
ershou/images/num/7.gif.gif
-
ershou/images/num/8.gif.gif
-
ershou/images/num/9.gif.gif
-
ershou/images/num/ico_x01.gif.gif
-
ershou/images/num/ico_x02.gif.gif
-
ershou/images/num/ico_x03.gif.gif
-
ershou/images/num/ico_x04.gif.gif
-
ershou/images/num/jsq.gif.gif
-
ershou/images/num/pic.gif.gif
-
ershou/images/point05.gif.gif
-
ershou/images/search.gif.gif
-
ershou/img/File_29.gif.gif
-
ershou/img/Login_but.gif.gif
-
ershou/img/Nav_Icon.gif.gif
-
ershou/img/_back.gif.gif
-
ershou/img/_doc_4.gif.gif
-
ershou/img/_form_r01_c6.gif.gif
-
ershou/img/_form_r02_c1.gif.gif
-
ershou/img/_form_r02_c7.gif.gif
-
ershou/img/_form_r07_c1.gif.gif
-
ershou/img/_form_r07_c3.gif.gif
-
ershou/img/_form_r07_c7.gif.gif
-
ershou/img/_form_r09_c1.gif.gif
-
ershou/img/_login_ERR_r5_c3.gif.gif
-
ershou/img/_more.gif.gif
-
ershou/img/b1.gif.gif
-
ershou/img/ba_home.gif.gif
-
ershou/img/bar_bg3.gif.gif
-
ershou/img/bg_b.gif.gif
-
ershou/img/bj1.gif.gif
-
ershou/img/bt_01_off.gif.gif
-
ershou/img/bt_02_off.gif.gif
-
ershou/img/bt_03_off.gif.gif
-
ershou/img/bt_04_off.gif.gif
-
ershou/img/bt_05_off.gif.gif
-
ershou/img/bt_06_off.gif.gif
-
ershou/img/buydj.gif.gif
-
ershou/img/con_help_off.gif.gif
-
ershou/img/con_sitemap.gif.gif
-
ershou/img/con_sitemap_off.gif.gif
-
ershou/img/djzh.gif.gif
-
ershou/img/dl003.gif.gif
-
ershou/img/dl004.gif.gif
-
ershou/img/editzl.gif.gif
-
ershou/img/form1_r2_c1.gif.gif
-
ershou/img/form1_r2_c3.gif.gif
-
ershou/img/form1_r5_c1.gif.gif
-
ershou/img/form2_r1_c1.gif.gif
-
ershou/img/form2_r3_c3.gif.gif
-
ershou/img/gbook.gif.gif
-
ershou/img/gbooktj.gif.gif
-
ershou/img/gonggao.gif.gif
-
ershou/img/guanli.gif.gif
-
ershou/img/hkzf.gif.gif
-
ershou/img/how_icon2.gif.gif
-
ershou/img/jfzh.gif.gif
-
ershou/img/left_form_r1_c1.gif.gif
-
ershou/img/left_form_r2_c1.gif.gif
-
ershou/img/left_form_r4_c1.gif.gif
-
ershou/img/line_01.gif.gif
-
ershou/img/links.gif.gif
-
ershou/img/login_r1_c1.gif.gif
-
ershou/img/login_r3_c1.gif.gif
-
ershou/img/login_r4_c1.gif.gif
-
ershou/img/logo.gif.gif
-
ershou/img/lsjl.gif.gif
-
ershou/img/mail_login_r1_c1.gif.gif
-
ershou/img/mail_login_r3_c1.gif.gif
-
ershou/img/mail_login_r5_c2.gif.gif
-
ershou/img/mail_login_r7_c1.gif.gif
-
ershou/img/mysc.gif.gif
-
ershou/img/news.gif.gif
-
ershou/img/obj_header_01.gif.gif
-
ershou/img/obj_header_02.gif.gif
-
ershou/img/obj_header_03.gif.gif
-
ershou/img/obj_header_04.gif.gif
-
ershou/img/obj_header_05.gif.gif
-
ershou/img/obj_logo.gif.gif
-
ershou/img/obj_ta3_01.gif.gif
-
ershou/img/obj_ta3_02.gif.gif
-
ershou/img/obj_ta3_03.gif.gif
-
ershou/img/obj_ta3_04.gif.gif
-
ershou/img/obj_ta3_05.gif.gif
-
ershou/img/obj_ta3_06.gif.gif
-
ershou/img/obj_ta3_07.gif.gif
-
ershou/img/obj_ta3_08.gif.gif
-
ershou/img/obj_ta3_09.gif.gif
-
ershou/img/obj_ta3_10.gif.gif
-
ershou/img/obj_ta3_11.gif.gif
-
ershou/img/obj_ta3_12.gif.gif
-
ershou/img/obj_ta3_whats-new.gif.gif
-
ershou/img/obj_ta_1.gif.gif
-
ershou/img/obj_ta_2.gif.gif
-
ershou/img/obj_ta_3.gif.gif
-
ershou/img/obj_ta_4.gif.gif
-
ershou/img/obj_ta_5.gif.gif
-
ershou/img/obj_ta_6.gif.gif
-
ershou/img/obj_ta_7.gif.gif
-
ershou/img/obj_ta_8.gif.gif
-
ershou/img/obj_waku3_01.gif.gif
-
ershou/img/obj_waku3_02.gif.gif
-
ershou/img/obj_waku3_03.gif.gif
-
ershou/img/obj_waku3_04.gif.gif
-
ershou/img/obj_waku3_05.gif.gif
-
ershou/img/obj_waku3_06.gif.gif
-
ershou/img/obj_waku3_07.gif.gif
-
ershou/img/one_doc.gif.gif
-
ershou/img/poco_bot770.jpg.jpg
-
ershou/img/point05.gif.gif
-
ershou/img/pro_r03_c5.gif.gif
-
ershou/img/readline.gif.gif
-
ershou/img/shim.gif.gif
-
ershou/img/sitelogo.gif.gif
-
ershou/img/sjzf.gif.gif
-
ershou/img/spacer.gif.gif
-
ershou/img/spacer1.gif.gif
-
ershou/img/submit.gif.gif
-
ershou/img/tan01.gif.gif
-
ershou/img/td1.gif.gif
-
ershou/img/td2.gif.gif
-
ershou/img/title_contact_sub.gif.gif
-
ershou/img/top.gif.gif
-
ershou/img/userbj.gif.gif
-
ershou/img/usersm.gif.gif
-
ershou/img/usertj.gif.gif
-
ershou/img/userzf.gif.gif
-
ershou/img/xxgl.gif.gif
-
ershou/img/yhzf.gif.gif
-
ershou/img/zf_1.gif.gif
-
ershou/img/zf_2.gif.gif
-
ershou/img/zfqr.gif.gif
-
ershou/img/zh2.gif.gif
-
ershou/index.asp.vbs
-
ershou/ipt.asp.vbs
-
ershou/ist-pay.htm.html
-
ershou/key.asp.vbs
-
ershou/leibie.asp.vbs
-
ershou/login.asp
-
ershou/loginchk.asp.vbs
-
ershou/mail.asp
-
ershou/md5.asp.vbs
-
ershou/moban.asp
-
ershou/readme.txt
-
ershou/reg.asp
-
ershou/reg1.asp
-
ershou/regchk.asp.vbs
-
ershou/regchk_2.asp.vbs
-
ershou/search.asp.vbs
-
ershou/top.asp
-
ershou/treaty.asp
-
ershou/upfile.asp.vbs
-
ershou/user.asp.vbs
-
ershou/user_qr.asp.vbs
-
ershou/user_qrchk.asp.vbs
-
ershou/user_sc.asp.vbs
-
ershou/user_scchk.asp.vbs
-
ershou/user_xxgl.asp.vbs
-
ershou/usercookies.asp.vbs
-
ershou/usereditzl.asp.vbs
-
ershou/usereditzlchk.asp.vbs
-
ershou/usergmdj.asp.vbs
-
ershou/usergmdjchk.asp.vbs
-
ershou/userleft.asp.html
-
ershou/userout.asp
-
ershou/vip.asp.vbs
-
ershou/xinxi_del.asp.vbs
-
ershou/xinxi_hf.asp.vbs
-
ershou/xinxi_mail.asp.vbs
-
ershou/xinxi_mailchk.asp.vbs
-
ershou/xinxi_sc.asp.vbs
-
ershou/xinximemo.asp.vbs
-
ershou/下载说明.htm.html .js polyglot