SmartHawk

4.6

中危

55 个模型检测该样本为恶意！

重新分析

下载样本

15873bc82641d61c8ec50de56a19389b44112e570800395fc7390190d51cccf3

09e912f35b64b9a311cc5a950fae37ae.exe

分析耗时

76s

最近分析

文件大小

28.5KB

静态报毒动态报毒 100% AI SCORE=100 ATRAPS BARYS BBINDI BLADABI BLADABINDI BMW@AY7KBDP CLASSIC CONFIDENCE CTOPXM DOTNETDL DOWNLOADER10 ELDORADO GDSDA GEN3 HIGH CONFIDENCE KX@52G0Y5 MALICIOUS PE NJRAT R + MAL R108665 RATENJAY RATJN REFROSO SCORE STATIC AI UNSAFE ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Backdoor:MSIL/Bladabindi.3c4f458c	20190527	0.3.0.5
Avast		20201231	21.1.5827.0
Tencent	Win32.Trojan.Generic.Isv	20201228	1.0.0.1
Baidu	MSIL.Backdoor.Bladabindi.a	20190318	1.0.0.2
Kingsoft		20201228	2017.9.26.565
McAfee		20201230	6.0.6.653
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619144351.696249 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Checks if process is being debugged by a debugger (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619134513.516886 IsDebuggerPresent		failed	0	0
1619144346.571249 IsDebuggerPresent		failed	0	0

Command line console output was observed (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619144352.148999 WriteConsoleA	buffer: ÖØÒªÐÅÏ¢: ÒÑ³É¹¦Ö´ÐÐÃüÁî¡£ µ«²»ÔÞ³ÉÊ¹ÓÃ "netsh firewall"£» ¶øÓ¦¸ÃÊ¹ÓÃ "netsh advfirewall firewall"¡£ ÓÐ¹ØÊ¹ÓÃ "netsh advfirewall firewall" ÃüÁî ¶ø·Ç "netsh firewall" µÄÏêÏ¸ÐÅÏ¢£¬Çë²ÎÔÄ http://go.microsoft.com/fwlink/?linkid=121488 ÉÏµÄ KB ÎÄÕÂ 947709¡£ console_handle: 0x00000007	success	1	0
1619144352.163999 WriteConsoleA	buffer: È·¶¨¡£ console_handle: 0x00000007	success	1	0

Allocates read-write-execute memory (usually to unpack itself) (46 个事件)

Time & API	Arguments	Status
1619134512.781886 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00790000	success
1619134512.797886 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00830000	success
1619134513.438886 NtProtectVirtualMemory	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f31000	success
1619134513.516886 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0040a000	success
1619134513.516886 NtProtectVirtualMemory	process_identifier: 2456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f32000	success
1619134513.516886 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00402000	success
1619134513.672886 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00412000	success
1619134513.750886 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004cb000	success
1619134513.750886 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004c7000	success
1619134513.781886 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00413000	success
1619134513.781886 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0041c000	success
1619134514.031886 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00414000	success
1619134514.203886 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00415000	success
1619134514.250886 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00660000	success
1619134514.250886 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0043a000	success
1619134514.281886 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00432000	success
1619134514.281886 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00416000	success
1619134514.500886 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004c5000	success
1619134514.672886 NtAllocateVirtualMemory	process_identifier: 2456 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0041a000	success
1619144346.477249 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00280000	success
1619144346.477249 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x002a0000	success
1619144346.539249 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f31000	success
1619144346.571249 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0043a000	success
1619144346.571249 NtProtectVirtualMemory	process_identifier: 2440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f32000	success
1619144346.571249 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00432000	success
1619144346.633249 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00442000	success
1619144346.649249 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0047b000	success
1619144346.649249 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00477000	success
1619144346.680249 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00443000	success
1619144346.680249 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0044c000	success
1619144346.711249 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00444000	success
1619144346.743249 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00445000	success
1619144346.743249 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00680000	success
1619144346.743249 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0046a000	success
1619144346.758249 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00462000	success
1619144346.758249 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00446000	success
1619144346.852249 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0045a000	success
1619144346.852249 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00457000	success
1619144346.868249 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00475000	success
1619144346.977249 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0043b000	success
1619144347.211249 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0044a000	success
1619144348.586249 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00456000	success
1619144348.586249 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00681000	success
1619144348.633249 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00e20000	success
1619144351.664249 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00e21000	success
1619144355.414249 NtAllocateVirtualMemory	process_identifier: 2440 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00433000	success

A process attempted to delay the analysis task. (1 个事件)

description

google Chrome.exe tried to sleep 120 seconds, actually delayed analysis time by 120 seconds

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619144348.633249 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Uses Windows utilities for basic Windows functionality (1 个事件)

cmdline

netsh firewall add allowedprogram "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" "google Chrome.exe" ENABLE

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Installs itself for autorun at Windows startup (50 out of 118 个事件)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\57c574cac01912135fb3df2e2ce85188	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\google Chrome.exe" ..

File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 个事件)

Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader10.41212
MicroWorld-eScan	Generic.MSIL.Bladabindi.8B97607C
FireEye	Generic.mg.09e912f35b64b9a3
CAT-QuickHeal	Backdoor.Bladabindi.AL3
ALYac	Generic.MSIL.Bladabindi.8B97607C
Cylance	Unsafe
VIPRE	Backdoor.MSIL.Bladabindi.a (v)
K7AntiVirus	Trojan ( 700000121 )
BitDefender	Generic.MSIL.Bladabindi.8B97607C
K7GW	Trojan ( 700000121 )
Cybereason	malicious.35b64b
BitDefenderTheta	Gen:NN.ZemsilF.34700.bmW@ay7kbdp
Cyren	W32/MSIL_Bladabindi.A.gen!Eldorado
Symantec	Backdoor.Ratenjay!gen3
TotalDefense	Win32/DotNetDl.A!generic
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Trojan.B-468
Kaspersky	HEUR:Trojan.Win32.Generic
Alibaba	Backdoor:MSIL/Bladabindi.3c4f458c
NANO-Antivirus	Trojan.Win32.Dwn.ctopxm
Tencent	Win32.Trojan.Generic.Isv
Ad-Aware	Generic.MSIL.Bladabindi.8B97607C
Sophos	Mal/Generic-R + Mal/Bbindi-C
Comodo	TrojWare.MSIL.Bladabindi.KX@52g0y5
F-Secure	Trojan.TR/ATRAPS.Gen
Baidu	MSIL.Backdoor.Bladabindi.a
Zillya	Trojan.Bladabindi.Win32.15180
TrendMicro	BKDR_BLADABI.SMC
McAfee-GW-Edition	BehavesLike.Win32.Trojan.mm
Emsisoft	Generic.MSIL.Bladabindi.8B97607C (B)
Ikarus	Trojan.MSIL.Bladabindi
Jiangmin	Trojan/Refroso.dep
Avira	TR/ATRAPS.Gen
Antiy-AVL	Trojan[Backdoor]/MSIL.Bladabindi.as
Microsoft	Backdoor:MSIL/Bladabindi.AJ
SUPERAntiSpyware	Trojan.Agent/Gen-Barys
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Generic.MSIL.Bladabindi.8B97607C
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Generic.R108665
Acronis	suspicious
MAX	malware (ai score=100)
Malwarebytes	Trojan.Agent.MSIL
ESET-NOD32	a variant of MSIL/Bladabindi.AS
TrendMicro-HouseCall	BKDR_BLADABI.SMC
Rising	Backdoor.Njrat!1.9E49 (CLASSIC)
Yandex	Trojan.RatJn.Gen.MG
SentinelOne	Static AI - Malicious PE

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-03-25 11:08:12

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
gostosa.freedynamicdns.org
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	50537	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.