0.7
低危
DACN
0.14
FACILE
1.00
IMCLNet
0.50
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | TrojanPSW:MSIL/Discord.6e202a60 | 20190527 | 0.3.0.5 |
| Avast | Win32:PWSX-gen [Trj] | 20220811 | 21.1.5827.0 |
| Baidu | None | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (W) | 20220418 | 1.0 |
| Kingsoft | Win32.PSWTroj.Undef.(kcloud) | 20220811 | 2017.9.26.565 |
| McAfee | PWS-FCOU!73C6FDDF35AB | 20220811 | 6.0.6.653 |
| Tencent | Win32.Trojan-qqpass.Qqrob.Aiig | 20220811 | 1.0.0.1 |
静态指标
此可执行文件具有 PDB 路径
(1 个事件)
| pdb_path | C:\Users\David\Downloads\AnarchyGrabber-master\AnarchyGrabber-master\AnarchyGrabber\obj\Debug\AnarchyGrabber.pdb |
动态指标
网络通信
文件已被 VirusTotal 上 57 个反病毒引擎识别为恶意
(50 out of 57 个事件)
| ALYac | IL:Trojan.MSILZilla.66342 |
| APEX | Malicious |
| AVG | Win32:PWSX-gen [Trj] |
| Acronis | suspicious |
| Ad-Aware | IL:Trojan.MSILZilla.66342 |
| AhnLab-V3 | Trojan/Win32.Agent.C3414125 |
| Alibaba | TrojanPSW:MSIL/Discord.6e202a60 |
| Antiy-AVL | Trojan/Generic.ASMalwS.33C |
| Avast | Win32:PWSX-gen [Trj] |
| Avira | HEUR/AGEN.1240909 |
| BitDefender | IL:Trojan.MSILZilla.66342 |
| BitDefenderTheta | Gen:NN.ZemsilF.34592.am0@aGuvgKn |
| CAT-QuickHeal | Trojan.YakbeexMSIL.ZZ4 |
| ClamAV | Win.Malware.Razy-9636401-0 |
| Comodo | Malware@#2r8debew1d1bi |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cybereason | malicious.f35ab9 |
| Cylance | Unsafe |
| Cynet | Malicious (score: 99) |
| Cyren | W32/Razy.EM.gen!Eldorado |
| DrWeb | Trojan.PWS.Stealer.27269 |
| ESET-NOD32 | a variant of MSIL/PSW.Agent.RFZ |
| Elastic | malicious (high confidence) |
| Emsisoft | IL:Trojan.MSILZilla.66342 (B) |
| FireEye | Generic.mg.73c6fddf35ab96fd |
| Fortinet | MSIL/Agent.RFZ!tr |
| GData | MSIL.Trojan-Stealer.DiscordStealer.D |
| Detected | |
| Gridinsoft | Trojan.Win32.Wacatac.dd!ni |
| Ikarus | Trojan-Spy.AnarchyGrabber |
| Jiangmin | Trojan.PSW.Multi.fj |
| K7AntiVirus | Trojan ( 0056cfce1 ) |
| K7GW | Password-Stealer ( 00555d941 ) |
| Kaspersky | HEUR:Trojan-PSW.Multi.Disco.gen |
| Kingsoft | Win32.PSWTroj.Undef.(kcloud) |
| Lionic | Trojan.MSIL.Agent.i!c |
| MAX | malware (ai score=83) |
| Malwarebytes | Spyware.AnarchyGrabber |
| MaxSecure | Trojan.Malware.9723143.susgen |
| McAfee | PWS-FCOU!73C6FDDF35AB |
| McAfee-GW-Edition | PWS-FCOU!73C6FDDF35AB |
| MicroWorld-eScan | IL:Trojan.MSILZilla.66342 |
| Microsoft | Trojan:MSIL/Discord |
| NANO-Antivirus | Trojan.Win32.Razy.gdezzy |
| Panda | Trj/CI.A |
| Rising | Stealer.AnarchyGrabber!1.C254 (CLASSIC) |
| SUPERAntiSpyware | Trojan.Agent/Generic |
| Sangfor | Suspicious.Win32.Save.a |
| SentinelOne | Static AI - Malicious PE |
| Sophos | Mal/Generic-R + Troj/MSIL-NMA |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2104-07-23 22:34:07
PDB Path
C:\Users\David\Downloads\AnarchyGrabber-master\AnarchyGrabber-master\AnarchyGrabber\obj\Debug\AnarchyGrabber.pdb
PE Imphash
f34d5f2d4577ed6d9ceec516c1f5a744
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00002000 | 0x00001924 | 0x00001a00 | 5.251262818393597 |
| .rsrc | 0x00004000 | 0x000005dc | 0x00000600 | 4.149086992262156 |
| .reloc | 0x00006000 | 0x0000000c | 0x00000200 | 0.08153941234324169 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_VERSION | 0x00004090 | 0x0000034c | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_MANIFEST | 0x000043ec | 0x000001ea | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
Imports
Library mscoree.dll:
• 0x402000 _CorExeMain
L!This program cannot be run in DOS mode.
`.rsrc
@.reloc
v4.0.30319
#Strings
IEnumerable`1
Task`1
TaskAwaiter`1
List`1
KeyValuePair`2
Dictionary`2
<Module>
System.IO
mscorlib
System.Collections.Generic
PostAsync
<TokensFound>k__BackingField
ReadToEnd
get_TokensFound
set_TokensFound
Service
HttpResponseMessage
AddRange
Enumerable
IDisposable
_serviceName
get_UserName
System.Core
Capture
Dispose
DebuggerBrowsableState
CompilerGeneratedAttribute
GuidAttribute
DebuggableAttribute
DebuggerBrowsableAttribute
ComVisibleAttribute
AssemblyTitleAttribute
AssemblyTrademarkAttribute
TargetFrameworkAttribute
AssemblyFileVersionAttribute
AssemblyConfigurationAttribute
AssemblyDescriptionAttribute
CompilationRelaxationsAttribute
AssemblyProductAttribute
AssemblyCopyrightAttribute
AssemblyCompanyAttribute
RuntimeCompatibilityAttribute
get_Value
AnarchyGrabber.exe
System.Runtime.Versioning
String
_servicePath
GetFolderPath
Webhook
_hookUrl
Program
get_Item
set_Item
System
System.Reflection
MatchCollection
FileInfo
DirectoryInfo
System.Net.Http
System.Linq
AnarchyGrabber
StreamReader
TextReader
SpecialFolder
GetAwaiter
IEnumerator
GetEnumerator
.cctor
System.Diagnostics
System.Runtime.InteropServices
System.Runtime.CompilerServices
_services
DebuggingModes
Matches
GetFiles
_searchLogs
checkLogs
System.Threading.Tasks
GetTokens
ReportTokens
System.Text.RegularExpressions
System.Collections
Concat
Object
Distinct
GetResult
HttpClient
Environment
get_Current
FormUrlEncodedContent
HttpContent
get_Count
Insert
TokenReport
tokenReport
ToList
MoveNext
OpenText
a`o4HK)
WrapNonExceptionThrows
AnarchyGrabber
Copyright
2019
$a19069bb-bd9a-4ca8-b8eb-5862dda44c02
0.0.2.0
.NETFramework,Version=v4.6.1
FrameworkDisplayName
.NET Framework 4.6.1
RSDSdq_HM
C:\Users\David\Downloads\AnarchyGrabber-master\AnarchyGrabber-master\AnarchyGrabber\obj\Debug\AnarchyGrabber.pdb
_CorExeMain
mscoree.dll
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false"/>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
\ A p p D a t a \
\ L o c a l S t o r a g e \ l e v e l d b
[ \ w - ] { 2 4 } \ . [ \ w - ] { 6 } \ . [ \ w - ] { 2 7 }
m f a \ . [ \ w - ] { 8 4 }
- N E W E S T
D i s c o r d
R o a m i n g \ D i s c o r d
D i s c o r d C a n a r y
R o a m i n g \ d i s c o r d c a n a r y
D i s c o r d P T B
R o a m i n g \ d i s c o r d p t b
G o o g l e C h r o m e
L o c a l \ G o o g l e \ C h r o m e \ U s e r D a t a \ D e f a u l t
R o a m i n g \ O p e r a S o f t w a r e \ O p e r a S t a b l e
L o c a l \ B r a v e S o f t w a r e \ B r a v e - B r o w s e r \ U s e r D a t a \ D e f a u l t
Y a n d e x
L o c a l \ Y a n d e x \ Y a n d e x B r o w s e r \ U s e r D a t a \ D e f a u l t
c o n t e n t
T o k e n r e p o r t f o r '
u s e r n a m e
A n a r c h y T o k e n G r a b b e r
a v a t a r _ u r l
h t t p s : / / m e d i a . d i s c o r d a p p . n e t / a t t a c h m e n t s / 6 0 1 4 5 7 5 4 4 3 8 0 0 2 2 7 9 0 / 6 0 9 8 2 4 9 1 8 0 2 8 4 1 9 0 8 2 / A n a r c h y . p n g
h t t p s : / / d i s c o r d a p p . c o m / a p i / w e b h o o k s / 6 3 3 0 4 0 6 2 9 9 3 2 2 2 8 6 0 8 / R 0 E a W 3 R f G H - e x Z p g J f 0 A F U 3 J Q - R O 9 n - j 9 k z g 1 l q I u k f k Q R p 9 X P X - 4 Y n O S H b Y G d d X h _ W 3
V S _ V E R S I O N _ I N F O
V a r F i l e I n f o
T r a n s l a t i o n
S t r i n g F i l e I n f o
0 0 0 0 0 4 b 0
C o m m e n t s
C o m p a n y N a m e
F i l e D e s c r i p t i o n
A n a r c h y G r a b b e r
F i l e V e r s i o n
0 . 0 . 2 . 0
I n t e r n a l N a m e
A n a r c h y G r a b b e r . e x e
L e g a l C o p y r i g h t
C o p y r i g h t
2 0 1 9
L e g a l T r a d e m a r k s
O r i g i n a l F i l e n a m e
A n a r c h y G r a b b e r . e x e
P r o d u c t N a m e
A n a r c h y G r a b b e r
P r o d u c t V e r s i o n
0 . 0 . 2 . 0
A s s e m b l y V e r s i o n
0 . 0 . 2 . 0
Process Tree
- 00c71692e748c0283923a6fdf7a18ae442ab87416a788d23c1ff8c785736fce1.exe (1848) "C:\Users\Administrator\AppData\Local\Temp\00c71692e748c0283923a6fdf7a18ae442ab87416a788d23c1ff8c785736fce1.exe"
Hosts
No hosts contacted.
DNS
No domains contacted.
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.