Overview
overview
7Static
static
3黑客风�...33.bat
windows7-x64
3黑客风�...33.bat
windows10-2004-x64
7黑客风�...��.url
windows7-x64
1黑客风�...��.url
windows10-2004-x64
1黑客风�.../s.exe
windows7-x64
3黑客风�.../s.exe
windows10-2004-x64
3黑客风�...ip.exe
windows7-x64
1黑客风�...ip.exe
windows10-2004-x64
1黑客风�...��.exe
windows7-x64
1黑客风�...��.exe
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
黑客风云全套抓鸡工具/1433.bat
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
黑客风云全套抓鸡工具/1433.bat
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
黑客风云全套抓鸡工具/173绿色软件.url
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
黑客风云全套抓鸡工具/173绿色软件.url
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
黑客风云全套抓鸡工具/s.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
黑客风云全套抓鸡工具/s.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
黑客风云全套抓鸡工具/vip.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
黑客风云全套抓鸡工具/vip.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
黑客风云全套抓鸡工具/黑客风云全套抓鸡工具(国庆版).exe
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
黑客风云全套抓鸡工具/黑客风云全套抓鸡工具(国庆版).exe
Resource
win10v2004-20231215-en
General
-
Target
0c325e2b4018d2f45f0de319d2783b20
-
Size
1.4MB
-
MD5
0c325e2b4018d2f45f0de319d2783b20
-
SHA1
64f9eb34e90cea01a2b0d6d5258f2a42894f0f97
-
SHA256
95d60cd2c564773a198e9fd75b9584fb1ee8613e5a8664c3b419fcba629736b1
-
SHA512
42d9513346bd20c651fc6ae46a5484858b4e40fb033d34d10d258b3f6b534377f124226fb3e4065b8dac3257ca94075d88142d1b971ff24d8c14cb6b24d72703
-
SSDEEP
24576:htg6I3xo0V42ijsQ1vx+rzyKqbiNDBCKncgxqgDhoBY1AC7Yj7SWbDNuKGdLOt3r:hS6cVjPQ1p+z/q8CKcezDhf1Aue7jpuw
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/黑客风云全套抓鸡工具/s.exe unpack001/黑客风云全套抓鸡工具/vip.exe unpack001/黑客风云全套抓鸡工具/黑客风云全套抓鸡工具(国庆版).exe
Files
-
0c325e2b4018d2f45f0de319d2783b20.rar
-
黑客风云全套抓鸡工具/1433.bat
-
黑客风云全套抓鸡工具/173绿色软件.url
-
黑客风云全套抓鸡工具/173软件下载.txt
-
黑客风云全套抓鸡工具/ip.txt
-
黑客风云全套抓鸡工具/s.exe.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
code Size: - Virtual size: 100KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
text Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
rsrc Size: 204B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 532B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
黑客风云全套抓鸡工具/s.txt
-
黑客风云全套抓鸡工具/vip.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 800B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
黑客风云全套抓鸡工具/不要点这里/vip.u3
-
黑客风云全套抓鸡工具/黑客风云全套抓鸡工具(国庆版).exe.exe windows:4 windows x86 arch:x86
9165ea3e914e03bda3346f13edbd6ccd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
LoadLibraryA
CloseHandle
WriteFile
CreateDirectoryA
GetTempPathA
ReadFile
SetFilePointer
CreateFileA
GetModuleFileNameA
GetStringTypeA
LCMapStringW
LCMapStringA
HeapAlloc
HeapFree
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
GetStringTypeW
user32
MessageBoxA
wsprintfA
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 956KB - Virtual size: 956KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ