Overview
overview
3Static
static
1info/Qpay/config.asp
windows7-x64
3info/Qpay/config.asp
windows10-2004-x64
3info/Qpay/get.vbs
windows7-x64
1info/Qpay/get.vbs
windows10-2004-x64
1info/Qpay/md32.vbs
windows7-x64
1info/Qpay/md32.vbs
windows10-2004-x64
1info/Qpay/post.vbs
windows7-x64
1info/Qpay/post.vbs
windows10-2004-x64
1info/about/about.htm
windows7-x64
1info/about/about.htm
windows10-2004-x64
1info/about...k.html
windows7-x64
1info/about...k.html
windows10-2004-x64
1info/about...hk.vbs
windows7-x64
1info/about...hk.vbs
windows10-2004-x64
1info/about/ads.htm
windows7-x64
1info/about/ads.htm
windows10-2004-x64
1info/about/conn.asp
windows7-x64
3info/about/conn.asp
windows10-2004-x64
3info/about/help.asp
windows7-x64
3info/about/help.asp
windows10-2004-x64
3info/about/lianus.htm
windows7-x64
1info/about/lianus.htm
windows10-2004-x64
1info/about/link.vbs
windows7-x64
1info/about/link.vbs
windows10-2004-x64
1info/about/link.htm
windows7-x64
1info/about/link.htm
windows10-2004-x64
1info/about/mian.htm
windows7-x64
1info/about/mian.htm
windows10-2004-x64
1info/addfree.js
windows7-x64
1info/addfree.js
windows10-2004-x64
1info/addfreechk.vbs
windows7-x64
1info/addfreechk.vbs
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
info/Qpay/config.asp
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
info/Qpay/config.asp
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
info/Qpay/get.vbs
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
info/Qpay/get.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
info/Qpay/md32.vbs
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
info/Qpay/md32.vbs
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
info/Qpay/post.vbs
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
info/Qpay/post.vbs
Resource
win10v2004-20231222-en
Behavioral task
behavioral9
Sample
info/about/about.htm
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
info/about/about.htm
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
info/about/addlink.html
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
info/about/addlink.html
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
info/about/addlinkchk.vbs
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
info/about/addlinkchk.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
info/about/ads.htm
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
info/about/ads.htm
Resource
win10v2004-20231222-en
Behavioral task
behavioral17
Sample
info/about/conn.asp
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
info/about/conn.asp
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
info/about/help.asp
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
info/about/help.asp
Resource
win10v2004-20231222-en
Behavioral task
behavioral21
Sample
info/about/lianus.htm
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
info/about/lianus.htm
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
info/about/link.vbs
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
info/about/link.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
info/about/link.htm
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
info/about/link.htm
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
info/about/mian.htm
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
info/about/mian.htm
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
info/addfree.js
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
info/addfree.js
Resource
win10v2004-20231222-en
Behavioral task
behavioral31
Sample
info/addfreechk.vbs
Resource
win7-20231215-en
Behavioral task
behavioral32
Sample
info/addfreechk.vbs
Resource
win10v2004-20231215-en
General
-
Target
7bb1c3648a33f99f85bee4d8392336b3
-
Size
1.2MB
-
MD5
7bb1c3648a33f99f85bee4d8392336b3
-
SHA1
ac5c0c9bdc053cf6d9a5052ef4e9f8dee6af07b7
-
SHA256
5992b3778905829883fedbb68c6a54e0625351f28f274c06b4b1022839ff7682
-
SHA512
6fb9ff51ebd2d098aa8ae60b5ad2bbbdb387e2ee1e6c0ed14de301392f8312ad4c05ea722b46baaf1cb7c912f8970b2a402b760eb77974b452caf7d08397b4e5
-
SSDEEP
24576:/n/36kdF+h29iCl3LXiwX3OJuvmy0rhJgN5jwioiVB5gKwKTKqKqfJP://36kyhEQuvqJCjGsx
Malware Config
Signatures
Files
-
7bb1c3648a33f99f85bee4d8392336b3.rar
-
info/QQ在线使用方法.txt
-
info/Qpay/config.asp
-
info/Qpay/get.asp.vbs
-
info/Qpay/md32.asp.vbs
-
info/Qpay/post.asp.vbs
-
info/about/about.htm
-
info/about/addlink.asp.html
-
info/about/addlinkchk.asp.vbs
-
info/about/ads.htm
-
info/about/conn.asp.asp .vbs polyglot
-
info/about/css.css
-
info/about/help.asp
-
info/about/img/j.gif.gif
-
info/about/img/msg.gif.gif
-
info/about/img/nologo.gif.gif
-
info/about/img/qq.gif.gif
-
info/about/img/top.gif.gif
-
info/about/img/toplogo.gif.gif
-
info/about/img/url.gif
-
info/about/lianus.htm
-
info/about/link.asp.vbs
-
info/about/link.htm
-
info/about/mian.htm
-
info/ad/002.gif.gif
-
info/ad/ad.gif.gif
-
info/ad/ad11.gif.gif
-
info/ad/ad21.gif.gif
-
info/ad/ad5.gif.gif
-
info/ad/banner.gif.gif
-
info/ad/ershou.gif.gif
-
info/ad/help.gif.gif
-
info/ad/help.psd
-
info/ad/new.gif.gif
-
info/ad/top.gif.gif
-
info/addfree.asp.js
-
info/addfreechk.asp.vbs
-
info/addxinxi.asp.vbs
-
info/addxinxichk.asp.vbs
-
info/admin/DEL_BUK.ASP.vbs
-
info/admin/add_user.asp
-
info/admin/add_userchk.asp.vbs
-
info/admin/addgonggao.asp
-
info/admin/addgonggaochk.asp.vbs
-
info/admin/addzs.asp
-
info/admin/addzschk.asp.vbs
-
info/admin/admin_add.asp.vbs
-
info/admin/admin_addchk.asp.vbs
-
info/admin/admin_chk.asp.vbs
-
info/admin/admin_chklogin.asp.asp .vbs polyglot
-
info/admin/admin_dd.asp.vbs
-
info/admin/admin_login.asp.asp
-
info/admin/admin_logout.asp.asp
-
info/admin/adminmail.asp
-
info/admin/adminmailchk.asp.vbs
-
info/admin/admintitle.asp.vbs
-
info/admin/admintitlechk.asp.vbs
-
info/admin/beifendata.asp.vbs
-
info/admin/checkcode.asp.vbs
-
info/admin/conn.asp.vbs
-
info/admin/cookies.asp.vbs
-
info/admin/dd_del.asp.vbs
-
info/admin/dd_yz.asp.vbs
-
info/admin/del_all.asp.vbs
-
info/admin/delgonggao.asp.vbs
-
info/admin/delhf.asp.vbs
-
info/admin/deluser.asp.vbs
-
info/admin/delxinxi.asp.vbs
-
info/admin/delzs.asp.vbs
-
info/admin/editgonggao.asp.vbs
-
info/admin/editxinxi.asp.vbs
-
info/admin/editzs.asp.vbs
-
info/admin/fenlei.asp.vbs
-
info/admin/fenlei_2.asp.vbs
-
info/admin/fenlei_2chk.asp.vbs
-
info/admin/fenlei_2edit.asp.vbs
-
info/admin/fenlei_2editchk.asp.vbs
-
info/admin/fenlei_2editdel.asp.vbs
-
info/admin/fenlei_html.asp.vbs
-
info/admin/fenleiedit.asp.vbs
-
info/admin/gbook.asp.js
-
info/admin/gbookdel.asp.vbs
-
info/admin/gbookedit.asp.vbs
-
info/admin/gbookhf.asp.vbs
-
info/admin/img/bg.gif.gif
-
info/admin/img/ershou_1.gif.gif
-
info/admin/img/ershou_2.gif.gif
-
info/admin/img/ershou_3.gif.gif
-
info/admin/img/left_form_r1_c1.gif.gif
-
info/admin/img/left_form_r2_c1.gif.gif
-
info/admin/img/left_form_r4_c1.gif.gif
-
info/admin/img/r3.gif.gif
-
info/admin/img/xx.gif.gif
-
info/admin/inc_style.css
-
info/admin/index.asp
-
info/admin/left.asp.html
-
info/admin/link.asp.vbs
-
info/admin/link_del.asp.vbs
-
info/admin/link_e.asp.vbs
-
info/admin/link_e_chk.asp.vbs
-
info/admin/link_yz.asp.vbs
-
info/admin/list_buk.asp.vbs
-
info/admin/listgonggao.asp.vbs
-
info/admin/listzs.asp.vbs
-
info/admin/main.asp.vbs
-
info/admin/out.asp
-
info/admin/right.asp.vbs
-
info/admin/user_del.asp.vbs
-
info/admin/user_editdj.asp.vbs
-
info/admin/user_editdjchk.asp.vbs
-
info/admin/user_edithb.asp.vbs
-
info/admin/user_edithbchk.asp.vbs
-
info/admin/user_editmail.asp.vbs
-
info/admin/user_editmailchk.asp.vbs
-
info/admin/user_editpass.asp.vbs
-
info/admin/user_editpasschk.asp.vbs
-
info/admin/user_editzj.asp.vbs
-
info/admin/user_editzjchk.asp.vbs
-
info/admin/user_gl.asp.vbs
-
info/admin/user_passchk.asp.vbs
-
info/admin/user_vip.asp.vbs
-
info/admin/user_vipdel.asp.vbs
-
info/admin/userlist.asp.vbs
-
info/admin/xinxi.asp.vbs
-
info/admin/xinxi_del.asp.vbs
-
info/admin/xinxi_edit.asp.vbs
-
info/admin/xinxi_editchk.asp.vbs
-
info/admin/xinxi_hf.asp.vbs
-
info/admin/xinxi_hfdel.asp.vbs
-
info/admin/xinxi_mail.asp.vbs
-
info/admin/xinxi_mailchk.asp.vbs
-
info/admin/xinxi_tj.asp.vbs
-
info/admin/xinxi_tjdel.asp.vbs
-
info/admin/xinxi_yz.asp.vbs
-
info/admin/xinximail.asp.vbs
-
info/admin/xinximailchk.asp.vbs
-
info/bar.asp
-
info/bar.inc.vbs
-
info/bar1.inc.vbs
-
info/chksql.Asp.vbs
-
info/classlist.asp.vbs
-
info/cnmai.inc.html .vbs polyglot
-
info/cnmaiqq.asp.js
-
info/config.asp
-
info/conn.asp.asp .vbs polyglot
-
info/conn1.asp.vbs
-
info/data/cnmaisqlin.mdb
-
info/data/dsjka#[email protected]
-
info/default.asp.vbs
-
info/default1.asp.vbs
-
info/edit_xinxi.asp.vbs
-
info/edit_xinxi_a.asp.vbs
-
info/edit_xinxi_b.asp.vbs
-
info/edit_xinxi_c.asp.vbs
-
info/edit_xinxi_d.asp.vbs
-
info/edit_xinxichk.asp.vbs
-
info/end.htm
-
info/err.asp.vbs
-
info/fenlei.html
-
info/fenlei_1.html
-
info/gbook.asp.vbs
-
info/gbookchk.asp.vbs
-
info/gbookchkweb.asp.vbs
-
info/gg.asp.vbs
-
info/ggzn.asp.vbs
-
info/gonggao.asp.vbs
-
info/images/File_29.gif.gif
-
info/images/Login_but.gif.gif
-
info/images/Nav_Icon.gif.gif
-
info/images/Search.gif.gif
-
info/images/_back.gif.gif
-
info/images/_doc_4.gif.gif
-
info/images/_form_r01_c6.gif.gif
-
info/images/_form_r02_c1.gif.gif
-
info/images/_form_r02_c7.gif.gif
-
info/images/_form_r07_c1.gif.gif
-
info/images/_form_r07_c3.gif.gif
-
info/images/_form_r07_c7.gif.gif
-
info/images/_form_r09_c1.gif.gif
-
info/images/_login_ERR_r5_c3.gif.gif
-
info/images/_more.gif.gif
-
info/images/a.psd
-
info/images/a0.gif.gif
-
info/images/a1.gif.gif
-
info/images/a2.gif.gif
-
info/images/a3.gif.gif
-
info/images/a4.gif.gif
-
info/images/a5.gif.gif
-
info/images/a6.gif.gif
-
info/images/a7.gif.gif
-
info/images/a8.gif.gif
-
info/images/ba_home.gif.gif
-
info/images/bar1.gif.gif
-
info/images/bar_bg3.gif.gif
-
info/images/bg.gif.gif
-
info/images/bg1.gif.gif
-
info/images/bg_top_01.gif.gif
-
info/images/bj1.gif.gif
-
info/images/bookmark.gif.gif
-
info/images/buydj.gif.gif
-
info/images/cnmai_down.gif.gif
-
info/images/cnmai_middle.gif.gif
-
info/images/cnmai_up.gif.gif
-
info/images/djzh.gif.gif
-
info/images/dl003.gif.gif
-
info/images/dl004.gif.gif
-
info/images/dotline.gif.gif
-
info/images/editzl.gif.gif
-
info/images/fa.gif.gif
-
info/images/find.gif.gif
-
info/images/folder.gif.gif
-
info/images/form1_r2_c1.gif.gif
-
info/images/form1_r2_c3.gif.gif
-
info/images/form1_r5_c1.gif.gif
-
info/images/form2_r1_c1.gif.gif
-
info/images/fx.gif
-
info/images/gb.gif.gif
-
info/images/gbook.gif.gif
-
info/images/gbooktj.gif.gif
-
info/images/hf.jpg.jpg
-
info/images/hkzf.gif.gif
-
info/images/inded_left-bg.gif.gif
-
info/images/jfzh.gif.gif
-
info/images/left_form_r1_c1.gif.gif
-
info/images/left_form_r2_c1.gif.gif
-
info/images/left_form_r4_c1.gif.gif
-
info/images/line_01.gif.gif
-
info/images/line_top_01.gif.gif
-
info/images/list3.gif.gif
-
info/images/logo.gif.gif
-
info/images/lsjl.gif.gif
-
info/images/mail_login_r1_c1.gif.gif
-
info/images/mail_login_r3_c1.gif.gif
-
info/images/mail_login_r5_c2.gif.gif
-
info/images/mail_login_r7_c1.gif.gif
-
info/images/msg.gif.gif
-
info/images/mysc.gif.gif
-
info/images/new.gif.gif
-
info/images/num/0.gif.gif
-
info/images/num/1.gif.gif
-
info/images/num/2.gif.gif
-
info/images/num/3.gif.gif
-
info/images/num/4.gif.gif
-
info/images/num/5.gif.gif
-
info/images/num/6.gif.gif
-
info/images/num/7.gif.gif
-
info/images/num/8.gif.gif
-
info/images/num/9.gif.gif
-
info/images/num/jian.gif.gif
-
info/images/num/jsq.gif.gif
-
info/images/num/pic.gif.gif
-
info/images/obj_ta3_01.gif.gif
-
info/images/obj_ta3_03.gif.gif
-
info/images/obj_ta3_04.gif.gif
-
info/images/obj_ta3_05.gif.gif
-
info/images/obj_ta3_06.gif.gif
-
info/images/obj_ta3_07.gif.gif
-
info/images/obj_ta3_08.gif.gif
-
info/images/obj_ta3_09.gif.gif
-
info/images/obj_ta3_10.gif.gif
-
info/images/obj_ta3_11.gif.gif
-
info/images/obj_ta3_12.gif.gif
-
info/images/obj_ta_1.gif.gif
-
info/images/obj_ta_2.gif.gif
-
info/images/obj_ta_3.gif.gif
-
info/images/obj_ta_4.gif.gif
-
info/images/obj_ta_5.gif.gif
-
info/images/obj_ta_6.gif.gif
-
info/images/obj_ta_7.gif.gif
-
info/images/obj_ta_8.gif.gif
-
info/images/obj_waku3_01.gif.gif
-
info/images/obj_waku3_02.gif.gif
-
info/images/obj_waku3_03.gif.gif
-
info/images/obj_waku3_04.gif.gif
-
info/images/obj_waku3_05.gif.gif
-
info/images/obj_waku3_06.gif.gif
-
info/images/obj_waku3_07.gif.gif
-
info/images/pic.gif.gif
-
info/images/point05.gif.gif
-
info/images/post.gif.gif
-
info/images/pro_r03_c5.gif.gif
-
info/images/pub.gif.gif
-
info/images/qq.css
-
info/images/qq.gif.gif
-
info/images/qqoffline.gif.gif
-
info/images/qqonline.gif.gif
-
info/images/search.jpg.jpg
-
info/images/sjzf.gif.gif
-
info/images/url.gif
-
info/images/user_pass.gif.gif
-
info/images/userbj.gif.gif
-
info/images/usersm.gif.gif
-
info/images/usertj.gif.gif
-
info/images/userzf.gif.gif
-
info/images/xx.gif.gif
-
info/images/xxgl.gif.gif
-
info/images/yhzf.gif.gif
-
info/images/zf_1.gif.gif
-
info/images/zf_2.gif.gif
-
info/images/zfqr.gif.gif
-
info/images/zh2.gif.gif
-
info/inc_style.css
-
info/index.asp.vbs
-
info/info.asp.vbs
-
info/ip.asp.vbs
-
info/ipt.asp.vbs
-
info/ist-pay.htm.html
-
info/js.asp.vbs
-
info/link.asp.vbs
-
info/login.asp
-
info/loginchk.asp.vbs
-
info/mail.asp
-
info/md5.asp.vbs
-
info/new.asp.vbs
-
info/reg.asp
-
info/reg1.asp
-
info/regchk.asp.vbs
-
info/regchk_2.asp.vbs
-
info/search.asp.vbs
-
info/tj.asp.vbs
-
info/tj0.asp.js
-
info/tj1.asp.vbs
-
info/top.asp
-
info/top1.asp
-
info/upfile.asp.vbs
-
info/uptupian/20051011131857.jpg.jpg
-
info/uptupian/20051011132421.jpg.jpg
-
info/uptupian/20051011132923.jpg.jpg
-
info/uptupian/20051011193336.jpg.jpg
-
info/uptupian/200510115354.jpg.jpg
-
info/uptupian/2005101153554.jpg.jpg
-
info/uptupian/2005101184125.jpg.jpg
-
info/uptupian/2005101184326.jpg.jpg
-
info/uptupian/200510316348.jpg.jpg
-
info/uptupian/20051051152.jpg.jpg
-
info/uptupian/2005711224110.jpg.jpg
-
info/uptupian/200572223826.jpg.jpg
-
info/uptupian/200572225216.jpg.jpg
-
info/uptupian/20057222562.jpg.jpg
-
info/uptupian/200572231218.jpg.jpg
-
info/uptupian/200582013243355.jpg.jpg
-
info/uptupian/2005820143316147.jpg.jpg
-
info/uptupian/200582014364.jpg.jpg
-
info/uptupian/200582014395.jpg.jpg
-
info/uptupian/20058311240.gif.gif
-
info/uptupian/200591113461.jpg.jpg
-
info/uptupian/200591791047.jpg.jpg
-
info/uptupian/20062623213.jpg.jpg
-
info/uptupian/Thumbs.db
-
info/user.asp.vbs
-
info/user_gbook.asp.vbs
-
info/user_gbookchk.asp.vbs
-
info/user_gbookchkweb.asp.vbs
-
info/user_pass.asp
-
info/user_passchk.asp.vbs
-
info/user_qr.asp.vbs
-
info/user_qrchk.asp.vbs
-
info/user_sc.asp.vbs
-
info/user_scchk.asp.vbs
-
info/user_xxgl.asp.vbs
-
info/user_zl.asp.vbs
-
info/usercookies.asp.vbs
-
info/userdjzh.asp.vbs
-
info/userdjzhchk.asp.vbs
-
info/userdjzhchk1.asp.vbs
-
info/usereditzl.asp.vbs
-
info/usereditzlchk.asp.vbs
-
info/usergmdj.asp.vbs
-
info/usergmdjchk.asp.vbs
-
info/usergmhb.asp.vbs
-
info/userleft.asp.html
-
info/userout.asp
-
info/vip.asp.vbs
-
info/xinxi_del.asp.vbs
-
info/xinxi_editzj.asp.vbs
-
info/xinxi_hf.asp.vbs
-
info/xinxi_mail.asp.vbs
-
info/xinxi_mailchk.asp.vbs
-
info/xinxi_sc.asp.vbs
-
info/xinximemo.asp.vbs
-
info/zn.ASP.vbs
-
info/zs.ASP.vbs
-
info/本程序已加入Qpay技术联盟.doc.doc windows office2003
-
info/程序说明.txt