Extracted

• • Target

    -°¦n+¦++.exe

  • Size

    1.6MB

  • MD5

    fa829b4b0756226de8b2b479f91c82f2

  • SHA1

    9073db73807de596b99bec8ff7c54da632afb399

  • SHA256

    b6cd133de42501483a7ba656c8727fe3f69961f0d9e3be7bafaf7747c68df775

  • SHA512

    4cce7a3bc488e3c1108cd43305c182d56287345379123c8800055305d8bff6f6bf2b01e5f7f49d140c8d2b1f965b879de53bebca38755aa386b730d610e3d2ad

  • SSDEEP

    49152:YrI6IISPM8EtQYJ7z0NdzF1Ech9P7Hg4F8hmslwX9:YYdPM3tQWf0jR19h9zUNg9

  Score

  1^/10
  behavioral1

• • Target

    PC远控测试-.exe

  • Size

    2.6MB

  • MD5

    b044b1bd454046017979442448a8e390

  • SHA1

    ded32e08fde6485cd314872f0b5ee9d8b66233d2

  • SHA256

    e351be996b4035fddffa0cbf6385568263edb38da2f6997487c15ac5fef3d905

  • SHA512

    2334eeec197ff2ea07edb8ec165ad0fd3494d29adebfea4131c91081adb5705a9fc0f8683941869f7aaefc114857049001ca241aed585ec8dea42b2c76b305f8

  • SSDEEP

    49152:VB38U5zFk1NhxsDT1T47R5FPfnH/EZUlimHQB5TxTE4CYn1bfHY2o:VtV74xswQBJxtf1b

  Score

  3^/10
  behavioral2

• • Target

    vip文件捆绑器.exe

  • Size

    1.4MB

  • MD5

    234673b74b8cf63fd7632fd016d5bf97

  • SHA1

    b8879f89fb52c9a28adf6cb7a76fc4153a9ee498

  • SHA256

    4f60677b90c4ef6a130b8df6ecacce77b8a3c10e2a38d9e76b03b169ae83f4cd

  • SHA512

    5994c95447a37afae559dd4846b8ca9af4e6dd6450145d3201ecc66cfd0377b61bbc47a454f6934e08fe2bc1c64b5ed8705e2006542e8029cdd5ae7551107b13

  • SSDEEP

    24576:89BQEqTGgNnJhiK54h0IvBkEp3W8AD/Dhd+y4lqJ8QdCYDoDNKn0RbpaoG8vn+Q:83XgtJhT9IvBsvD/DX+y4onCYDoDlNao

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral3

• • Target

    菲律宾王小柔疫情期间宾馆做爱视频流出.MP4.bat

  • Size

    340KB

  • MD5

    f2b6aae38b2a7d7eccd29f0293420d72

  • SHA1

    da9209e98438a66c6453010f65e2b5c427382963

  • SHA256

    db0c34fd60009271f420ab7adaf04d4476d7939892b217930fffcb9757be60e2

  • SHA512

    d3c49e2d6fb731c747144e1bb301f390aeb34b1e399c841bc76287519d6ad13cb34e4a3ae24986b0f43e94c31d40e357d51d360a436b7651a4d539c8fad99951

  • SSDEEP

    6144:uAtrKrjDnYCADp9VekbJ2tPJKA1jImwa6mcF:DmYpDFbJ2s0jIxmc

  Score

  6^/10

  discoverypersistence

  • Adds Run key to start application

    persistence
  behavioral4

• • Target

    远程控制 测试- (2).bat

  • Size

    1.9MB

  • MD5

    44726e1af933ac9132a40f8c00c44e48

  • SHA1

    b18df355daf0060c46d1eda4f7e068c1788405c2

  • SHA256

    455d89a6e91d21bfb20ecd18f48faf8bfe67a3e3e115d737695aa1fc3883e2b4

  • SHA512

    74e4eace0b660e1a12701533dea886218b9846fad69d5316aa835196f8713eb6ae68402b5281d27e9274aab40f1a3762bb98ddc4a5e54b24a13be8a784515c71

  • SSDEEP

    49152:ArC7FLl2Fk6TN8pO3LEKx5iM8h5ZTvS8mQZ47Kxc1cAArVJiVjefVFLS:fLl2Fk6TaO3LEKx5i5ZTSjQZ4mxi/ark

  Score

  3^/10

  discovery
  behavioral5

• • Target

    远程控制 测试- (2).exe

  • Size

    1.9MB

  • MD5

    44726e1af933ac9132a40f8c00c44e48

  • SHA1

    b18df355daf0060c46d1eda4f7e068c1788405c2

  • SHA256

    455d89a6e91d21bfb20ecd18f48faf8bfe67a3e3e115d737695aa1fc3883e2b4

  • SHA512

    74e4eace0b660e1a12701533dea886218b9846fad69d5316aa835196f8713eb6ae68402b5281d27e9274aab40f1a3762bb98ddc4a5e54b24a13be8a784515c71

  • SSDEEP

    49152:ArC7FLl2Fk6TN8pO3LEKx5iM8h5ZTvS8mQZ47Kxc1cAArVJiVjefVFLS:fLl2Fk6TaO3LEKx5i5ZTSjQZ4mxi/ark

  Score

  3^/10

  discovery
  behavioral6

• • Target

    远程控制 测试-.bat

  • Size

    1.9MB

  • MD5

    1abafb07254557a7e1c4045d16765c4d

  • SHA1

    024ff7967ccc6e1237e74d23f2fab9840994a03b

  • SHA256

    b784b6c6eb56fb91cb881a18e5e5ce630c96b5e49b131363c4776a097bb4bdea

  • SHA512

    f24eabcdcfc932a9fb15042e200f8b2caf41cb2d7e718977fbaf16a14d8e1bbcf29cf7d7bdca715e0e26a88f7162b2ae8a4c2968f8036d940fd0e96d1ccf959f

  • SSDEEP

    49152:lzvq2Kp7NXRRBChNoRhUfERKbVNK7hiwUOdj4rhEOX66VEl56r:o2Kp7NXlChNoRhRAbVNK7hiw14rKm669

  Score

  3^/10

  discovery
  behavioral7

• • Target

    远程控制 测试-.exe

  • Size

    1.9MB

  • MD5

    1abafb07254557a7e1c4045d16765c4d

  • SHA1

    024ff7967ccc6e1237e74d23f2fab9840994a03b

  • SHA256

    b784b6c6eb56fb91cb881a18e5e5ce630c96b5e49b131363c4776a097bb4bdea

  • SHA512

    f24eabcdcfc932a9fb15042e200f8b2caf41cb2d7e718977fbaf16a14d8e1bbcf29cf7d7bdca715e0e26a88f7162b2ae8a4c2968f8036d940fd0e96d1ccf959f

  • SSDEEP

    49152:lzvq2Kp7NXRRBChNoRhUfERKbVNK7hiwUOdj4rhEOX66VEl56r:o2Kp7NXlChNoRhRAbVNK7hiw14rKm669

  Score

  3^/10

  discovery
  behavioral8

• • Target

    钱包收款地址强制更改器- (2).exe

  • Size

    2.2MB

  • MD5

    4aa53cd852b2160cfe36a6623e099649

  • SHA1

    63dadd832dc0c5d5a40a229a48bc5aa01ab59bc6

  • SHA256

    3b98e8614b4244e0ffe0ddb86a07d8d35524ec36bc4a79ea89b556d246738ee1

  • SHA512

    444f967c9c73435156746a82acaba6af74f7eb458b03e17e1f9cabbe7eae9f2bc106d9c798660ad2c1ac96211072c1e93f0c8e499770ee60987f381ab2d42bf8

  • SSDEEP

    49152:ZQSZnqs5EVcsYSijtkw9ga68mhcAP0xYHw/ZgAa0h7hYs8Id69UVgx6y:WkqKEVc7tkw9g98mHPCYHw/+Mh9Zfd6J

  Score

  3^/10

  discovery
  behavioral9

• • Target

    钱包收款地址强制更改器-.exe

  • Size

    1.8MB

  • MD5

    3009b7339dc5d42d9e303b44f0ac909d

  • SHA1

    b2dd5280172f5b3f6580fbc9ef668752d76cccf6

  • SHA256

    52575ef4a36b8a7c426e53dc595f7ec4680e972125a106aab51799e74dda2a45

  • SHA512

    9c6b58083f241ea948d6e0445d228e0f7e0edc2c5a5f907328c27555d5febdff5e0f111e89dc1ca5490e487618ca35c12f60f0b945452615bee698476f47030d

  • SSDEEP

    49152:YYDYIdixGgyRXDBRomq2hI+Vz7SAjqElseu/V5fLBYA9ULRUh:YhIdcGFx9Romq2G+VHSAjqEaJVhV1ULq

  Score

  3^/10

  discovery
  behavioral10