Overview
overview
10Static
static
10hezb/样�...14FEB1
ubuntu-18.04-amd64
hezb/样�...14FEB1
debian-9-armhf
hezb/样�...14FEB1
debian-9-mips
hezb/样�...14FEB1
debian-9-mipsel
hezb/样�...AA484D
ubuntu-18.04-amd64
hezb/样�...AA484D
debian-9-armhf
hezb/样�...AA484D
debian-9-mips
hezb/样�...AA484D
debian-9-mipsel
hezb/样�...254E2C
ubuntu-24.04-amd64
6hezb/样�...2C0CFB
ubuntu-24.04-amd64
10hezb/样�...F3E8C3
ubuntu-24.04-amd64
6hezb/样�...49.ps1
windows7-x64
3hezb/样�...49.ps1
windows10-2004-x64
3hezb/样�...D2.ps1
windows7-x64
3hezb/样�...D2.ps1
windows10-2004-x64
3hezb/样�...DE.exe
windows7-x64
1hezb/样�...DE.exe
windows10-2004-x64
1Behavioral task
behavioral1
Sample
hezb/样本/Linux/sh恶意脚本/955ABC9598BEFCA8025B806E9E14FEB1
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
hezb/样本/Linux/sh恶意脚本/955ABC9598BEFCA8025B806E9E14FEB1
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
hezb/样本/Linux/sh恶意脚本/955ABC9598BEFCA8025B806E9E14FEB1
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
hezb/样本/Linux/sh恶意脚本/955ABC9598BEFCA8025B806E9E14FEB1
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral5
Sample
hezb/样本/Linux/sh恶意脚本/B954CBA4C2A5ED68CE8AC88BF4AA484D
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral6
Sample
hezb/样本/Linux/sh恶意脚本/B954CBA4C2A5ED68CE8AC88BF4AA484D
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral7
Sample
hezb/样本/Linux/sh恶意脚本/B954CBA4C2A5ED68CE8AC88BF4AA484D
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral8
Sample
hezb/样本/Linux/sh恶意脚本/B954CBA4C2A5ED68CE8AC88BF4AA484D
Resource
debian9-mipsel-20240729-en
Behavioral task
behavioral9
Sample
hezb/样本/Linux/恶意软件/19827AF3181C12EE7A89CEE51F254E2C
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral10
Sample
hezb/样本/Linux/挖矿程序/ED573E9B9087C650D06CFB76C62C0CFB
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral11
Sample
hezb/样本/Linux/漏洞利用程序/8E3E276E650E6EA21BEA16C8C2F3E8C3
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral12
Sample
hezb/样本/Windows/bat恶意脚本/CB160E725249E2C0534EB01EC3D8E049.ps1
Resource
win7-20240903-en
Behavioral task
behavioral13
Sample
hezb/样本/Windows/bat恶意脚本/CB160E725249E2C0534EB01EC3D8E049.ps1
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
hezb/样本/Windows/bat恶意脚本/F7DA4506E638185AF1F1B2FE30A2E9D2.ps1
Resource
win7-20240903-en
Behavioral task
behavioral15
Sample
hezb/样本/Windows/bat恶意脚本/F7DA4506E638185AF1F1B2FE30A2E9D2.ps1
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
hezb/样本/Windows/挖矿程序/3EDCDE37DCECB1B5A70B727EA36521DE.exe
Resource
win7-20241023-en
Behavioral task
behavioral17
Sample
hezb/样本/Windows/挖矿程序/3EDCDE37DCECB1B5A70B727EA36521DE.exe
Resource
win10v2004-20241007-en
General
-
Target
hezb.zip
-
Size
6.3MB
-
MD5
de79dc65c13418d2e9dca7af8c21d3e6
-
SHA1
9dbe9e7f1ca1dd69ac5258fbc2acf8c6ad320264
-
SHA256
a0c236fed9935b975ceba78c77343c6c2a1d0ac64ccff00e08328d0b8af360c4
-
SHA512
427cebf0ce77e355823409d24d0f53d42e6d6e9c5dc63c42ab1215f539256831c4e9fd8b44cde8894c8f39682e3095da555c0e280424823bd2d4cb66b27cf312
-
SSDEEP
98304:CM+B5I5UqFFhVqvIyYPnOV3+JmuVTmwFgdb2ip7B/0FxMWNfIBCHh:c5I5DF+v0OAJm2TmVz7gx9NkCB
Malware Config
Signatures
-
XMRig Miner payload 4 IoCs
resource yara_rule static1/unpack001/hezb/样本/Linux/挖矿程序/ED573E9B9087C650D06CFB76C62C0CFB xmrig static1/unpack001/hezb/样本/Linux/挖矿程序/ED573E9B9087C650D06CFB76C62C0CFB family_xmrig static1/unpack001/hezb/样本/Windows/挖矿程序/3EDCDE37DCECB1B5A70B727EA36521DE xmrig static1/unpack001/hezb/样本/Windows/挖矿程序/3EDCDE37DCECB1B5A70B727EA36521DE family_xmrig -
Xmrig family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/hezb/样本/Windows/挖矿程序/3EDCDE37DCECB1B5A70B727EA36521DE
Files
-
hezb.zip.zip
Password: infected
-
hezb/样本/Linux/sh恶意脚本/955ABC9598BEFCA8025B806E9E14FEB1.sh linux
-
hezb/样本/Linux/sh恶意脚本/B954CBA4C2A5ED68CE8AC88BF4AA484D.sh linux
-
hezb/样本/Linux/恶意软件/19827AF3181C12EE7A89CEE51F254E2C.elf linux x64
-
hezb/样本/Linux/挖矿程序/ED573E9B9087C650D06CFB76C62C0CFB.elf linux x64
-
hezb/样本/Linux/挖矿配置文件/101661518965EA842D703D02D84933D8
-
hezb/样本/Linux/漏洞利用程序/8E3E276E650E6EA21BEA16C8C2F3E8C3.elf linux x64
-
hezb/样本/Windows/bat恶意脚本/CB160E725249E2C0534EB01EC3D8E049.ps1
-
hezb/样本/Windows/bat恶意脚本/F7DA4506E638185AF1F1B2FE30A2E9D2.ps1
-
hezb/样本/Windows/挖矿程序/3EDCDE37DCECB1B5A70B727EA36521DE.exe windows:6 windows x64 arch:x64
Password: infected
f582800aab9508d46a8a2582b5ab586d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
recv
ntohs
htons
send
WSASetLastError
WSAGetLastError
select
WSARecvFrom
WSASocketW
WSASend
WSARecv
WSAIoctl
gethostname
WSADuplicateSocketW
shutdown
getpeername
FreeAddrInfoW
GetAddrInfoW
htonl
socket
setsockopt
listen
closesocket
bind
WSACleanup
WSAStartup
getsockopt
getsockname
ioctlsocket
iphlpapi
GetAdaptersAddresses
userenv
GetUserProfileDirectoryW
crypt32
CertGetCertificateContextProperty
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
kernel32
GetStdHandle
SetConsoleMode
GetConsoleMode
QueryPerformanceFrequency
QueryPerformanceCounter
SizeofResource
LockResource
LoadResource
FindResourceW
ExpandEnvironmentStringsA
GetConsoleWindow
GetSystemFirmwareTable
HeapFree
HeapAlloc
GetProcessHeap
MultiByteToWideChar
SetPriorityClass
GetCurrentProcess
SetThreadPriority
GetSystemPowerStatus
GetCurrentThread
GetProcAddress
GetModuleHandleW
GetTickCount
CloseHandle
FreeConsole
VirtualProtect
VirtualFree
VirtualAlloc
GetLargePageMinimum
LocalAlloc
GetLastError
LocalFree
FlushInstructionCache
GetCurrentThreadId
AddVectoredExceptionHandler
DeviceIoControl
GetModuleFileNameW
CreateFileW
SetLastError
GetSystemTime
SystemTimeToFileTime
GetModuleHandleExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToFiber
DeleteFiber
CreateFiber
FindClose
FindFirstFileW
FindNextFileW
WideCharToMultiByte
GetFileType
WriteFile
ConvertFiberToThread
ConvertThreadToFiber
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeLibrary
LoadLibraryA
LoadLibraryW
GetEnvironmentVariableW
ReadConsoleA
ReadConsoleW
PostQueuedCompletionStatus
CreateFileA
DuplicateHandle
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
Sleep
QueueUserWorkItem
RegisterWaitForSingleObject
UnregisterWait
GetNumberOfConsoleInputEvents
ReadConsoleInputW
FillConsoleOutputCharacterW
FillConsoleOutputAttribute
GetConsoleCursorInfo
SetConsoleCursorInfo
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
SetConsoleTextAttribute
WriteConsoleInputW
CreateDirectoryW
FlushFileBuffers
GetDiskFreeSpaceW
SetConsoleTitleA
GetFileInformationByHandle
WriteConsoleW
GetFinalPathNameByHandleW
GetFullPathNameW
ReadFile
RemoveDirectoryW
SetFilePointerEx
SetFileTime
GetSystemInfo
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
CreateFileMappingA
ReOpenFile
CopyFileW
MoveFileExW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
InitializeCriticalSection
SetConsoleCtrlHandler
GetCurrentDirectoryW
GetLongPathNameW
GetShortPathNameW
CreateIoCompletionPort
ReadDirectoryChangesW
VerSetConditionMask
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetCurrentDirectoryW
GetTempPathW
GlobalMemoryStatusEx
VerifyVersionInfoA
FileTimeToSystemTime
RtlUnwind
K32GetProcessMemoryInfo
SetHandleInformation
CancelIoEx
CancelIo
SwitchToThread
SetFileCompletionNotificationModes
LoadLibraryExW
FormatMessageA
SetErrorMode
GetQueuedCompletionStatus
ConnectNamedPipe
PeekNamedPipe
CreateNamedPipeW
CancelSynchronousIo
TerminateProcess
GetExitCodeProcess
UnregisterWaitEx
LCMapStringW
DebugBreak
TryEnterCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
ReleaseSemaphore
ResumeThread
GetNativeSystemInfo
CreateSemaphoreA
GetModuleHandleA
GetStartupInfoW
GetModuleFileNameA
GetVersionExA
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
GetComputerNameA
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
GetStringTypeW
RtlVirtualUnwind
GetFileSizeEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetStdHandle
GetCommandLineA
GetCommandLineW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
ExitProcess
GetFileAttributesExW
SetFileAttributesW
GetConsoleCP
CompareStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
GetTimeZoneInformation
HeapSize
SetEndOfFile
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetFileAttributesW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
WaitForSingleObjectEx
GetExitCodeThread
SleepConditionVariableSRW
EncodePointer
DecodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
user32
GetProcessWindowStation
GetUserObjectInformationW
ShowWindow
GetLastInputInfo
DispatchMessageA
GetMessageA
GetSystemMetrics
MapVirtualKeyW
TranslateMessage
MessageBoxW
shell32
SHGetSpecialFolderPathA
ole32
CoInitializeEx
CoCreateInstance
CoUninitialize
advapi32
SystemFunction036
GetUserNameW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CreateServiceW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
QueryServiceConfigA
DeleteService
ControlService
StartServiceW
OpenServiceW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
LsaOpenPolicy
LsaAddAccountRights
LsaClose
GetTokenInformation
bcrypt
BCryptGenRandom
Sections
.text Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 62KB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 125KB - Virtual size: 125KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RANDOMX Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_SHA3_25 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT_CN Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT_CN Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
hezb/样本/Windows/挖矿配置文件/61DEF7B3B98458A40FFFA42A19DDF258