Overview

overview

7

Static

static

7

远程协�...xz.htm

windows7-x64

1

远程协�...xz.htm

windows10-2004-x64

1

远程协�...ad.dll

windows7-x64

1

远程协�...ad.dll

windows10-2004-x64

1

远程协�...ET.dll

windows7-x64

1

远程协�...ET.dll

windows10-2004-x64

1

远程协�...xz.htm

windows7-x64

1

远程协�...xz.htm

windows10-2004-x64

1

远程协�...xt.dll

windows7-x64

1

远程协�...xt.dll

windows10-2004-x64

1

远程协�...ln.dll

windows7-x64

1

远程协�...ln.dll

windows10-2004-x64

1

远程协�...ll.dll

windows7-x64

1

远程协�...ll.dll

windows10-2004-x64

1

远程协�...wx.dll

windows7-x64

1

远程协�...wx.dll

windows10-2004-x64

1

远程协�...�].exe

windows7-x64

1

远程协�...�].exe

windows10-2004-x64

1

远程协�...PI.dll

windows7-x64

1

远程协�...PI.dll

windows10-2004-x64

1

远程协�...er.dll

windows7-x64

1

远程协�...er.dll

windows10-2004-x64

1

远程协�...ln.dll

windows7-x64

1

远程协�...ln.dll

windows10-2004-x64

1

远程协�...ll.dll

windows7-x64

1

远程协�...ll.dll

windows10-2004-x64

1

远程协�...wx.dll

windows7-x64

1

远程协�...wx.dll

windows10-2004-x64

1

远程协�...�].exe

windows7-x64

1

远程协�...�].exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    9866c005fe8d669888d8f695b5afedb5

  • Size

    1.5MB

  • MD5

    9866c005fe8d669888d8f695b5afedb5

  • SHA1

    5b1021981f5bf5009b87c83bb6b10a08ebfa8fa2

  • SHA256

    df5354c5111b2ffaa45da6510f3f3ca7cb00b297a0be758a0aca678cf2fea05e

  • SHA512

    3cbfac3b96e4816fd6d79c858715ec211c0523289468bdbf089f2f27073918e3df2e6d00dda859cc2294b2ebdf46c3ba50ffb7d719dde66bddff5ff894e3933b

  • SSDEEP

    24576:A5jOYVzWF9IKrABDhlHuQgN4+8brs8uC03+lxaI3h5DZQYfhbZ+lDbUTs:wOYQFABfuNm+krCulImh5yY+nL

Score
7/10
aspackv2

Malware Config

Signatures

  • ASPack v2.12-2.42 10 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Unsigned PE 13 IoCs

    Checks for missing Authenticode signature.

Files

  • 9866c005fe8d669888d8f695b5afedb5
    .rar
  • 远程协助监控程序/gmxz.htm
    .html
  • 远程协助监控程序/help.txt
  • 远程协助监控程序/read.txt
  • 远程协助监控程序/下载说明.htm
    .html .js polyglot
  • 远程协助监控程序/远程协助监控-[控制端]/21.skn
  • 远程协助监控程序/远程协助监控-[控制端]/EThread.fne
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • 远程协助监控程序/远程协助监控-[控制端]/WININET.DLL
    .dll windows:5 windows x86 arch:x86

    f81cfbf7eea6aefa1cdc69460a876678


    Headers

    Imports

    Exports

    Sections

  • 远程协助监控程序/远程协助监控-[控制端]/gmxz.htm
    .html
  • 远程协助监控程序/远程协助监控-[控制端]/gmzc.sz
  • 远程协助监控程序/远程协助监控-[控制端]/help.txt
  • 远程协助监控程序/远程协助监控-[控制端]/iext.fnr
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • 远程协助监控程序/远程协助监控-[控制端]/krnln.fnr
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • 远程协助监控程序/远程协助监控-[控制端]/read.txt
  • 远程协助监控程序/远程协助监控-[控制端]/shell.fne
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • 远程协助监控程序/远程协助监控-[控制端]/xwx.fne
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • 远程协助监控程序/远程协助监控-[控制端]/远程协助监控-[控制端].exe
    .exe windows:4 windows x86 arch:x86

    ae0a5112fe1176f4e5f6e1bc95e4c209


    Headers

    Imports

    Sections

  • 远程协助监控程序/远程协助监控-[被控制端]/21.skn
  • 远程协助监控程序/远程协助监控-[被控制端]/eAPI.fne
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • 远程协助监控程序/远程协助监控-[被控制端]/eImgConverter.fne
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • 远程协助监控程序/远程协助监控-[被控制端]/krnln.fnr
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • 远程协助监控程序/远程协助监控-[被控制端]/shell.fne
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • 远程协助监控程序/远程协助监控-[被控制端]/xwx.fne
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • 远程协助监控程序/远程协助监控-[被控制端]/远程协助监控-[被控制端].exe
    .exe windows:4 windows x86 arch:x86

    ae0a5112fe1176f4e5f6e1bc95e4c209


    Headers

    Imports

    Sections