Overview
overview
7Static
static
7客户端�...te.exe
windows7-x64
1客户端�...te.exe
windows10-2004-x64
1客户端�...gr.exe
windows7-x64
1客户端�...gr.exe
windows10-2004-x64
1客户端�...lb.exe
windows7-x64
1客户端�...lb.exe
windows10-2004-x64
1客户端�...as.dll
windows7-x64
1客户端�...as.dll
windows10-2004-x64
1客户端�...tf.dll
windows7-x64
1客户端�...tf.dll
windows10-2004-x64
1客户端�...ar.dll
windows7-x64
3客户端�...ar.dll
windows10-2004-x64
3服务端/...te.exe
windows7-x64
1服务端/...te.exe
windows10-2004-x64
1服务端/...er.dll
windows7-x64
1服务端/...er.dll
windows10-2004-x64
1服务端/...er.dll
windows7-x64
3服务端/...er.dll
windows10-2004-x64
3服务端/RegTlb.exe
windows7-x64
1服务端/RegTlb.exe
windows10-2004-x64
1服务端/...er.exe
windows7-x64
3服务端/...er.exe
windows10-2004-x64
3服务端/buysale.dll
windows7-x64
1服务端/buysale.dll
windows10-2004-x64
1服务端/midas.dll
windows7-x64
1服务端/midas.dll
windows10-2004-x64
1服务端/qtintf.dll
windows7-x64
1服务端/qtintf.dll
windows10-2004-x64
1服务端/...vr.exe
windows7-x64
1服务端/...vr.exe
windows10-2004-x64
1服务端/unrar.dll
windows7-x64
3服务端/unrar.dll
windows10-2004-x64
3Analysis
- max time kernel
152s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
14/03/2024, 04:09
Behavioral task
behavioral1
Sample
客户端工具/AutoUpdate.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral2
Sample
客户端工具/AutoUpdate.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
客户端工具/ClientMgr.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
客户端工具/ClientMgr.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
客户端工具/RegTlb.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral6
Sample
客户端工具/RegTlb.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
客户端工具/midas.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
客户端工具/midas.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
客户端工具/qtintf.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
客户端工具/qtintf.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
客户端工具/unrar.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral12
Sample
客户端工具/unrar.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
服务端/AutoUpdate.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
服务端/AutoUpdate.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
服务端/Computer.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
服务端/Computer.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
服务端/IPSearcher.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
服务端/IPSearcher.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
服务端/RegTlb.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral20
Sample
服务端/RegTlb.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
服务端/YituServer.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral22
Sample
服务端/YituServer.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
服务端/buysale.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral24
Sample
服务端/buysale.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
服务端/midas.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral26
Sample
服务端/midas.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
服务端/qtintf.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral28
Sample
服务端/qtintf.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
服务端/scktsrvr.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral30
Sample
服务端/scktsrvr.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
服务端/unrar.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral32
Sample
服务端/unrar.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
General
- Target 服务端/scktsrvr.exe
- Size 262KB
- Sample240314-eqt2vaab2z
- SHA256 b90d215edd5c7f244c09646735b5c3eb7db337b1ac02a2f279c7c2270aa2c3eb
- MD5 b16fcc920552a573d3e3b0a2be1297d5
- SHA1 2f774bb0b113a185d3cd99ed161fcf79b4a63ba7
- SHA512 03371b8135ecfc8012cb062a36ee2cfed136d8b9ea3c90f9596a30a82643a90dd20f6167d4d3be889e57c7c8e4028b5990ac9ba570a178d7b104abfe7569ac0d
- SSDEEP 6144:KZo28u2FvFDcgoj+Pq2MZOHPby7Tz+z2+QdlqRxWY:FvFDc7W3MZOHWz+/x
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2028 scktsrvr.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2028 scktsrvr.exe