Overview

overview

7

Static

static

7

客户端.exe

windows7-x64

3

客户端.exe

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

athd.dll

windows7-x64

1

athd.dll

windows10-2004-x64

3

atwd.dll

windows7-x64

1

atwd.dll

windows10-2004-x64

1

client.exe

windows7-x64

1

client.exe

windows10-2004-x64

1

killproc.dll

windows7-x64

1

killproc.dll

windows10-2004-x64

3

mkh.dll

windows7-x64

1

mkh.dll

windows10-2004-x64

1

sfd.dll

windows7-x64

3

sfd.dll

windows10-2004-x64

3

shutdown.dll

windows7-x64

shutdown.dll

windows10-2004-x64

新云软件.url

windows7-x64

1

新云软件.url

windows10-2004-x64

1

服务端.exe

windows7-x64

3

服务端.exe

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

ATGD.dll

windows7-x64

1

ATGD.dll

windows10-2004-x64

1

ATWD.dll

windows7-x64

1

ATWD.dll

windows10-2004-x64

1

datatools.exe

windows7-x64

1

datatools.exe

windows10-2004-x64

1

server.exe

windows7-x64

1

server.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bc23715e50a86229c00c450a7c6daaf6

  • Size

    3.5MB

  • MD5

    bc23715e50a86229c00c450a7c6daaf6

  • SHA1

    3da4eac32886b60b11838561c2823634f55be9b8

  • SHA256

    582d7f4e2d0bb8532b315c13735fee4d992c1faa0689456b60b424b51415184a

  • SHA512

    941eebdd1f70b470f4a1d128e564ae9123d059842b81a438de0dee03460dbf1a155c4930c599d0de796a23fa1597e6d62376c63efb542994470125b0aa501811

  • SSDEEP

    98304:IPHGv1jyxyVDesIHoHvaXrDWZAcKMYEmn8o:IPQ1TIIHvaXrSZAcKREmn8o

Score
7/10
aspackv2

Malware Config

Signatures

  • ASPack v2.12-2.42 11 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Unsigned PE 16 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 3 IoCs
    installer

Files

  • bc23715e50a86229c00c450a7c6daaf6
    .rar
  • 客户端.exe
    .exe windows:4 windows x86 arch:x86

    18bc6fa81e19f21156316b1ae696ed6b


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • athd.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • atwd.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • client.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • killproc.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • mkh.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • sfd.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • shutdown.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • 新云软件.url
    .url
  • 服务端.exe
    .exe windows:4 windows x86 arch:x86

    18bc6fa81e19f21156316b1ae696ed6b


    Headers

    Imports

    Sections

  • $PLUGINSDIR/InstallOptions.dll
    .dll windows:4 windows x86 arch:x86

    57354bdeea3dfae6e948101add87501a


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/ioSpecial.ini
  • $PLUGINSDIR/modern-header.bmp
  • $PLUGINSDIR/modern-wizard.bmp
  • ATGD.DLL
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • ATWD.DLL
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • data/atcompmng.mdb
  • datatools.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • server.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    18bc6fa81e19f21156316b1ae696ed6b


    Headers

    Imports

    Sections

  • $PLUGINSDIR/modern-header.bmp