4.8
中危
47 个模型检测该样本为恶意！
重新分析
更多

7a1f126caa7226f2afffb5063b395d288a794823b61f8611003a49e45036d000

a03b607d50c407ade12a684046a5f079.exe

分析耗时

61s

最近分析

文件大小

6.0KB
静态报毒 动态报毒 100% AGEN AI SCORE=85 AM0@AMO0TGE ARTEMIS ATTRIBUTE BLOCKER CLOUD CONFIDENCE EVILNUM GDSDA GENERICKD HIGHCONFIDENCE LIQD MALICIOUS MALWARE@#40HN8MPCYHY R03BC0WFO20 RANSOMX RSHELL SCORE SUSGEN TIGGRE TSCOPE UNSAFE VDQP ZEMSILF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Artemis!A03B607D50C4 20200718 6.0.6.653
Baidu 20190318 1.0.0.2
Avast Win32:RansomX-gen [Ransom] 20200718 18.4.3895.0
Alibaba Trojan:MSIL/Evilnum.09231b75 20190527 0.3.0.5
Kingsoft 20200718 2013.8.14.323
Tencent Msil.Trojan.Blocker.Liqd 20200718 1.0.0.1
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
Queries for the computername (2 个事件)
Time & API Arguments Status Return Repeated
1619781481.09375
GetComputerNameA
computer_name: OSKAR-PC
success 1 0
1619781481.09375
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (4 个事件)
Time & API Arguments Status Return Repeated
1619781456.29675
IsDebuggerPresent
failed 0 0
1619781456.29675
IsDebuggerPresent
failed 0 0
1619781480.59375
IsDebuggerPresent
failed 0 0
1619781480.59375
IsDebuggerPresent
failed 0 0
Command line console output was observed (2 个事件)
Time & API Arguments Status Return Repeated
1619781481.21875
WriteConsoleA
buffer: Unhandled Exception:
console_handle: 0x0000000b
success 1 0
1619781485.29675
WriteConsoleA
buffer: System.Net.Sockets.SocketException: ÓÉÓÚÁ¬½Ó·½ÔÚÒ»¶Îʱ¼äºóûÓÐÕýÈ·´ð¸´»òÁ¬½ÓµÄÖ÷»úûÓз´Ó¦£¬Á¬½Ó³¢ÊÔʧ°Ü¡£ 10.10.1.176:443 at System.Net.Sockets.TcpClient..ctor(String hostname, Int32 port) at ConnectBack.Program.Main(String[] args)
console_handle: 0x0000000b
success 1 0
This executable has a PDB path (1 个事件)
pdb_path C:\Users\aaron\source\repos\rshell\obj\Debug\rshell.pdb
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619781456.31275
GlobalMemoryStatusEx
success 1 0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (23 个事件)
Time & API Arguments Status Return Repeated
1619781455.79675
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 983040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00610000
success 0 0
1619781455.79675
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x006c0000
success 0 0
1619781456.24975
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 2293760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02200000
success 0 0
1619781456.24975
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x023f0000
success 0 0
1619781456.26575
NtProtectVirtualMemory
process_identifier: 2344
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73b91000
success 0 0
1619781456.29675
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 1507328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00c40000
success 0 0
1619781456.29675
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00d70000
success 0 0
1619781456.29675
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0056a000
success 0 0
1619781456.29675
NtProtectVirtualMemory
process_identifier: 2344
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73b92000
success 0 0
1619781456.29675
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00562000
success 0 0
1619781456.48475
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00572000
success 0 0
1619781456.51575
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00595000
success 0 0
1619781456.53175
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0059b000
success 0 0
1619781456.53175
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00597000
success 0 0
1619781456.71875
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00573000
success 0 0
1619781456.74975
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0057c000
success 0 0
1619781457.04675
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00574000
success 0 0
1619781457.20275
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00586000
success 0 0
1619781457.20275
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x007a0000
success 0 0
1619781457.37475
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0058a000
success 0 0
1619781457.37475
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00587000
success 0 0
1619781480.43775
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00d71000
success 0 0
1619781481.67175
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00d72000
success 0 0
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 172.217.24.14
host 203.208.41.98
File has been identified by 47 AntiVirus engines on VirusTotal as malicious (47 个事件)
FireEye Generic.mg.a03b607d50c407ad
Qihoo-360 Generic/Trojan.Ransom.8af
McAfee Artemis!A03B607D50C4
Cylance Unsafe
Zillya Trojan.Blocker.Win32.61561
Sangfor Malware
K7AntiVirus Trojan ( 00568a411 )
BitDefender Trojan.GenericKD.34059381
K7GW Trojan ( 00568a411 )
Symantec ML.Attribute.HighConfidence
APEX Malicious
Avast Win32:RansomX-gen [Ransom]
Cynet Malicious (score: 85)
GData Trojan.GenericKD.34059381
Kaspersky HEUR:Trojan-Ransom.MSIL.Blocker.gen
Alibaba Trojan:MSIL/Evilnum.09231b75
Paloalto generic.ml
MicroWorld-eScan Trojan.GenericKD.34059381
Rising Ransom.Blocker!8.12A (CLOUD)
Emsisoft Trojan.GenericKD.34059381 (B)
Comodo Malware@#40hn8mpcyhy
F-Secure Heuristic.HEUR/AGEN.1110093
DrWeb BackDoor.RShell.166
VIPRE Trojan.Win32.Generic!BT
TrendMicro Ransom_Blocker.R03BC0WFO20
Sophos Mal/Generic-S
Cyren W32/Trojan.VDQP-2402
Webroot W32.Trojan.Gen
Avira HEUR/AGEN.1110093
Antiy-AVL Trojan[Ransom]/MSIL.Blocker
AegisLab Trojan.MSIL.Blocker.j!c
ZoneAlarm HEUR:Trojan-Ransom.MSIL.Blocker.gen
Microsoft Trojan:Win32/Tiggre!rfn
VBA32 TScope.Trojan.MSIL
ALYac Trojan.GenericKD.34059381
MAX malware (ai score=85)
Ad-Aware Trojan.GenericKD.34059381
ESET-NOD32 a variant of MSIL/Evilnum.A
TrendMicro-HouseCall Ransom_Blocker.R03BC0WFO20
Tencent Msil.Trojan.Blocker.Liqd
Ikarus Trojan.MSIL.Agent
Fortinet MSIL/Agent.CKA!tr
BitDefenderTheta Gen:NN.ZemsilF.34136.am0@amO0TGe
AVG Win32:RansomX-gen [Ransom]
Panda Trj/GdSda.A
CrowdStrike win/malicious_confidence_100% (W)
MaxSecure Trojan.Malware.300983.susgen
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)
dead_host 172.217.24.14:443
dead_host 10.10.1.176:443
dead_host 172.217.160.110:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2046-08-19 12:31:51

Imports

Library mscoree.dll:
• 0x402000 _CorExeMain

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 50568 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 62912 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.