SmartHawk

6.0

高危

64 个模型检测该样本为恶意！

重新分析

下载样本

845f3f7d59365c2cc41ef827fa7c9e146f7746dc0720937c7bd29049e42d81f2

9388181bd14e2086ad83ee8cec7cfcac.exe

分析耗时

82s

最近分析

文件大小

29.0KB

静态报毒动态报毒 100% AGXY AI SCORE=89 AUTOIT BARYS BBINDI BLADABI BLADABINDI BMW@A8LZBFK CLOUD CONFIDENCE DBXZFJ DISFA DOWNLOADER10 ELDORADO FIGN GDSDA HIGH CONFIDENCE HSSE HWMAQCCA KCLOUD KX@52G0Y5 LMGJ MALICIOUS PE NJRAT R + MAL RATENJAY SAVE SCORE SEKR STATIC AI SUSGEN UNSAFE ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Trojan-FIGN	20210412	6.0.6.653
Alibaba	Backdoor:MSIL/Bladabindi.db0775a4	20190527	0.3.0.5
Baidu	MSIL.Backdoor.Bladabindi.a	20190318	1.0.0.2
Avast	MSIL:Agent-BXF [Trj]	20210412	21.1.5827.0
Tencent	Win32.Trojan.Generic.Hsse	20210412	1.0.0.1
Kingsoft	Win32.Troj.Undef.(kcloud)	20210412	2017.9.26.565
CrowdStrike	win/malicious_confidence_100% (W)	20210203	1.0

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619791272.425249 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Checks if process is being debugged by a debugger (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619791264.205374 IsDebuggerPresent		failed	0	0
1619791267.019249 IsDebuggerPresent		failed	0	0

Command line console output was observed (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619791272.956124 WriteConsoleA	buffer: ÖØÒªÐÅÏ¢: ÒÑ³É¹¦Ö´ÐÐÃüÁî¡£ µ«²»ÔÞ³ÉÊ¹ÓÃ "netsh firewall"£» ¶øÓ¦¸ÃÊ¹ÓÃ "netsh advfirewall firewall"¡£ ÓÐ¹ØÊ¹ÓÃ "netsh advfirewall firewall" ÃüÁî ¶ø·Ç "netsh firewall" µÄÏêÏ¸ÐÅÏ¢£¬Çë²ÎÔÄ http://go.microsoft.com/fwlink/?linkid=121488 ÉÏµÄ KB ÎÄÕÂ 947709¡£ console_handle: 0x00000007	success	1	0
1619791272.956124 WriteConsoleA	buffer: È·¶¨¡£ console_handle: 0x00000007	success	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619791266.221374 GlobalMemoryStatusEx		success	1	0

Allocates read-write-execute memory (usually to unpack itself) (46 个事件)

Time & API	Arguments	Status
1619791263.205374 NtAllocateVirtualMemory	process_identifier: 2260 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x008c0000	success
1619791263.205374 NtAllocateVirtualMemory	process_identifier: 2260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00a90000	success
1619791264.080374 NtProtectVirtualMemory	process_identifier: 2260 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f31000	success
1619791264.205374 NtAllocateVirtualMemory	process_identifier: 2260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ba000	success
1619791264.205374 NtProtectVirtualMemory	process_identifier: 2260 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f32000	success
1619791264.205374 NtAllocateVirtualMemory	process_identifier: 2260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b2000	success
1619791264.690374 NtAllocateVirtualMemory	process_identifier: 2260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003c2000	success
1619791264.893374 NtAllocateVirtualMemory	process_identifier: 2260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003c3000	success
1619791264.908374 NtAllocateVirtualMemory	process_identifier: 2260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003fb000	success
1619791264.908374 NtAllocateVirtualMemory	process_identifier: 2260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f7000	success
1619791264.986374 NtAllocateVirtualMemory	process_identifier: 2260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003cc000	success
1619791265.268374 NtAllocateVirtualMemory	process_identifier: 2260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003c4000	success
1619791265.502374 NtAllocateVirtualMemory	process_identifier: 2260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003c5000	success
1619791265.502374 NtAllocateVirtualMemory	process_identifier: 2260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003c6000	success
1619791265.549374 NtAllocateVirtualMemory	process_identifier: 2260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006b0000	success
1619791265.549374 NtAllocateVirtualMemory	process_identifier: 2260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ea000	success
1619791265.580374 NtAllocateVirtualMemory	process_identifier: 2260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e2000	success
1619791265.877374 NtAllocateVirtualMemory	process_identifier: 2260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f5000	success
1619791266.065374 NtAllocateVirtualMemory	process_identifier: 2260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ca000	success
1619791266.894249 NtAllocateVirtualMemory	process_identifier: 2244 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00370000	success
1619791266.894249 NtAllocateVirtualMemory	process_identifier: 2244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00380000	success
1619791266.972249 NtProtectVirtualMemory	process_identifier: 2244 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f31000	success
1619791267.034249 NtAllocateVirtualMemory	process_identifier: 2244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003fa000	success
1619791267.034249 NtProtectVirtualMemory	process_identifier: 2244 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f32000	success
1619791267.034249 NtAllocateVirtualMemory	process_identifier: 2244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f2000	success
1619791267.144249 NtAllocateVirtualMemory	process_identifier: 2244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00402000	success
1619791267.237249 NtAllocateVirtualMemory	process_identifier: 2244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00403000	success
1619791267.237249 NtAllocateVirtualMemory	process_identifier: 2244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0043b000	success
1619791267.237249 NtAllocateVirtualMemory	process_identifier: 2244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00437000	success
1619791267.253249 NtAllocateVirtualMemory	process_identifier: 2244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0040c000	success
1619791267.378249 NtAllocateVirtualMemory	process_identifier: 2244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00404000	success
1619791267.409249 NtAllocateVirtualMemory	process_identifier: 2244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00405000	success
1619791267.409249 NtAllocateVirtualMemory	process_identifier: 2244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00406000	success
1619791267.409249 NtAllocateVirtualMemory	process_identifier: 2244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00700000	success
1619791267.425249 NtAllocateVirtualMemory	process_identifier: 2244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0042a000	success
1619791267.456249 NtAllocateVirtualMemory	process_identifier: 2244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00422000	success
1619791267.487249 NtAllocateVirtualMemory	process_identifier: 2244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00435000	success
1619791267.941249 NtAllocateVirtualMemory	process_identifier: 2244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0040a000	success
1619791269.191249 NtAllocateVirtualMemory	process_identifier: 2244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003fb000	success
1619791269.253249 NtAllocateVirtualMemory	process_identifier: 2244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00701000	success
1619791270.175249 NtAllocateVirtualMemory	process_identifier: 2244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0041a000	success
1619791270.175249 NtAllocateVirtualMemory	process_identifier: 2244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00417000	success
1619791272.206249 NtAllocateVirtualMemory	process_identifier: 2244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04790000	success
1619791273.597249 NtAllocateVirtualMemory	process_identifier: 2244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04791000	success
1619791279.191249 NtAllocateVirtualMemory	process_identifier: 2244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f3000	success
1619791279.206249 NtAllocateVirtualMemory	process_identifier: 2244 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0040b000	success

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619791274.941249 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Uses Windows utilities for basic Windows functionality (1 个事件)

cmdline

netsh firewall add allowedprogram "C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" "YourPhone.exe" ENABLE

Communicates with host for which no DNS query was performed (2 个事件)

host	157.245.220.192
host	172.217.24.14

Installs itself for autorun at Windows startup (50 out of 116 个事件)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bec01544ef6b0bb361f68d796213ad70	reg_value	"C:\Users\Administrator.Oskar-PC\AppData\Roaming\YourPhone.exe" ..

File has been identified by 64 AntiVirus engines on VirusTotal as malicious (50 out of 64 个事件)

Elastic	malicious (high confidence)
ClamAV	Win.Trojan.B-468
CAT-QuickHeal	Backdoor.Bladabindi.AL3
McAfee	Trojan-FIGN
Malwarebytes	Backdoor.Bladabindi.MSIL
Zillya	Trojan.Bladabindi.Win32.14971
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 700000121 )
Alibaba	Backdoor:MSIL/Bladabindi.db0775a4
K7GW	Trojan ( 700000121 )
Cybereason	malicious.bd14e2
Baidu	MSIL.Backdoor.Bladabindi.a
Cyren	W32/MSIL_Bladabindi.A.gen!Eldorado
Symantec	Backdoor.Ratenjay
ESET-NOD32	MSIL/Bladabindi.F
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Generic.MSIL.Bladabindi.D95839AA
NANO-Antivirus	Trojan.Win32.Dwn.dbxzfj
ViRobot	Backdoor.Win32.Bladabindi.Gen.A
SUPERAntiSpyware	Trojan.Agent/Gen-Barys
MicroWorld-eScan	Generic.MSIL.Bladabindi.D95839AA
Avast	MSIL:Agent-BXF [Trj]
Tencent	Win32.Trojan.Generic.Hsse
Ad-Aware	Generic.MSIL.Bladabindi.D95839AA
Sophos	Mal/Generic-R + Mal/Bbindi-C
Comodo	TrojWare.MSIL.Bladabindi.KX@52g0y5
F-Secure	Backdoor.BDS/Bladabindi.sekr
DrWeb	Trojan.DownLoader10.45391
VIPRE	Trojan.MSIL.Bladabindi.agxy (v)
TrendMicro	BKDR_BLADABI.SMC
McAfee-GW-Edition	BehavesLike.Win32.Trojan.mm
FireEye	Generic.mg.9388181bd14e2086
Emsisoft	Generic.MSIL.Bladabindi.D95839AA (B)
SentinelOne	Static AI - Malicious PE
GData	MSIL.Backdoor.Bladabindi.AV
Jiangmin	TrojanDropper.Autoit.dce
Webroot	W32.Trojan.Gen
Avira	BDS/Bladabindi.sekr
eGambit	RAT.njRat
Antiy-AVL	Trojan[Backdoor]/MSIL.Bladabindi.as
Kingsoft	Win32.Troj.Undef.(kcloud)
Arcabit	Generic.MSIL.Bladabindi.DD1765FAA
AegisLab	Trojan.Win32.Generic.lMGJ
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	Backdoor:MSIL/Bladabindi.AJ
AhnLab-V3	Trojan/Win32.Bladabindi.C202658
Acronis	suspicious

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (11 个事件)

dead_host	192.168.56.101:49181
dead_host	192.168.56.101:49194
dead_host	192.168.56.101:49191
dead_host	192.168.56.101:49193
dead_host	192.168.56.101:49190
dead_host	192.168.56.101:49192
dead_host	192.168.56.101:49179
dead_host	157.245.220.192:1177
dead_host	192.168.56.101:49186
dead_host	192.168.56.101:49183
dead_host	192.168.56.101:49195

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-01-18 12:00:22

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	53237	114.114.114.114	53
192.168.56.101	57756	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50003	239.255.255.250	3702
192.168.56.101	51966	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.