Overview
overview
10Static
static
10客户端(...EY.exe
windows7-x64
9客户端(...EY.exe
windows10-2004-x64
9UDP.exe
windows7-x64
3UDP.exe
windows10-2004-x64
3a
ubuntu-24.04-amd64
8arm1
debian-9-armhf
4bj.exe
windows7-x64
10bj.exe
windows10-2004-x64
10bjyk.exe
windows7-x64
10bjyk.exe
windows10-2004-x64
10cctv.exe
windows7-x64
7cctv.exe
windows10-2004-x64
10cctv_2.exe
windows7-x64
1cctv_2.exe
windows10-2004-x64
10cn.exe
windows7-x64
7cn.exe
windows10-2004-x64
7cn1.exe
windows7-x64
7cn1.exe
windows10-2004-x64
3dhl.exe
windows7-x64
10dhl.exe
windows10-2004-x64
10java
ubuntu-18.04-amd64
4java (2)
ubuntu-24.04-amd64
1java1
ubuntu-24.04-amd64
7k5.exe
windows7-x64
8k5.exe
windows10-2004-x64
10ly1
debian-9-mips
3mh.exe
windows7-x64
10mh.exe
windows10-2004-x64
10mips
debian-12-mipsel
4pjhxx
ubuntu-24.04-amd64
1rootkit
ubuntu-24.04-amd64
8se.exe
windows7-x64
7Analysis
-
max time kernel
94s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02-01-2025 21:33
Behavioral task
behavioral1
Sample
客户端(Client)_KEY.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
客户端(Client)_KEY.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
UDP.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
UDP.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
a
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral6
Sample
arm1
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral7
Sample
bj.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
bj.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
bjyk.exe
Resource
win7-20241023-en
Behavioral task
behavioral10
Sample
bjyk.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
cctv.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
cctv.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
cctv_2.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
cctv_2.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
cn.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
cn.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
cn1.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
cn1.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
dhl.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
dhl.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
java
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral22
Sample
java (2)
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral23
Sample
java1
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral24
Sample
k5.exe
Resource
win7-20241010-en
Behavioral task
behavioral25
Sample
k5.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral26
Sample
ly1
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral27
Sample
mh.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
mh.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
mips
Resource
debian12-mipsel-20240221-en
Behavioral task
behavioral30
Sample
pjhxx
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral31
Sample
rootkit
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral32
Sample
se.exe
Resource
win7-20240903-en
General
-
Target
UDP.exe
-
Size
31KB
-
MD5
161f6beec09cd33d710f8f97365ee6f6
-
SHA1
9c408d1b53a1d03e8c7a3f85e050870f3d9a741f
-
SHA256
f73a89b6a5c42d21ee4f7a4d79ad784cdfd896bbe2453b60cf9688786f7a9d98
-
SHA512
e9f2afd6ad8216fa0f34cca29ba4d8753a03b187f4e9c29a0607e9b2ad932b788cb9a75db54df0db522e2a20d54a12992ed2396f40f06ab8cd76a89bcbf1e6be
-
SSDEEP
384:+ubvs5ed2wcTZr5bDDOp61lpHwdkJAqJDPHYM:hshb9r5b3Op8lVbJTJwM
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDP.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5020 UDP.exe 5020 UDP.exe