Overview
overview
3Static
static
3KF修复/A...pi.dll
windows7-x64
3KF修复/A...pi.dll
windows10-2004-x64
3KF修复/A...pi.dll
windows7-x64
1KF修复/A...pi.dll
windows10-2004-x64
3KF修复/KF修复.bat
windows7-x64
1KF修复/KF修复.bat
windows10-2004-x64
1KF修复/adb.exe
windows7-x64
1KF修复/adb.exe
windows10-2004-x64
1KF修复/busybox
debian-9-armhf
1KF修复/zergRush
debian-9-armhf
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 03:32
Static task
static1
Behavioral task
behavioral1
Sample
KF修复/AdbWinApi.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
KF修复/AdbWinApi.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
KF修复/AdbWinUsbApi.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
KF修复/AdbWinUsbApi.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
KF修复/KF修复.bat
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
KF修复/KF修复.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
KF修复/adb.exe
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
KF修复/adb.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
KF修复/busybox
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral10
Sample
KF修复/zergRush
Resource
debian9-armhf-20240226-en
General
-
Target
KF修复/AdbWinUsbApi.dll
-
Size
59KB
-
MD5
5f23f2f936bdfac90bb0a4970ad365cf
-
SHA1
12e14244b1a5d04a261759547c3d930547f52fa3
-
SHA256
041c6859bb4fc78d3a903dd901298cd1ecfb75b6be0646b74954cd722280a407
-
SHA512
49a7769d5e6cb2fda9249039d90465f7a4e612805bba48b7036456a3bbd230e4d13da72e4ade5155ddc08fe460735ec8d6df3bb11b72ff28e1149221e2fc3048
-
SSDEEP
768:HLNk0yiFYWkgALpW+QvSugX0wUepQNXTQXdF+Q+An70edrqqOkIW:+yY8wugEwOVEXdz70e4gI
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2240 wrote to memory of 2288 2240 rundll32.exe rundll32.exe PID 2240 wrote to memory of 2288 2240 rundll32.exe rundll32.exe PID 2240 wrote to memory of 2288 2240 rundll32.exe rundll32.exe PID 2240 wrote to memory of 2288 2240 rundll32.exe rundll32.exe PID 2240 wrote to memory of 2288 2240 rundll32.exe rundll32.exe PID 2240 wrote to memory of 2288 2240 rundll32.exe rundll32.exe PID 2240 wrote to memory of 2288 2240 rundll32.exe rundll32.exe