| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| McAfee | 20200710 | 6.0.6.653 | |
| Alibaba | 20190527 | 0.3.0.5 | |
| Avast | 20200710 | 18.4.3895.0 | |
| Baidu | 20190318 | 1.0.0.2 | |
| Kingsoft | 20200710 | 2013.8.14.323 | |
| Tencent | 20200710 | 1.0.0.1 | |
| CrowdStrike | 20190702 | 1.0 |
| pdb_path | E:\pcgame\GameDownloader\Release\GameDownloader.pdb |
| resource name | INI |
| resource name | ZIP |
| suspicious_features | POST method with no referer header, POST method with no useragent header, Connection to IP address | suspicious_request | POST http://180.163.54.67:80/ | ||||||
| suspicious_features | POST method with no referer header, POST method with no useragent header, Connection to IP address | suspicious_request | POST http://47.97.7.140:80/ | ||||||
| suspicious_features | POST method with no referer header, POST method with no useragent header, Connection to IP address | suspicious_request | POST http://180.163.202.66:80/ | ||||||
| suspicious_features | POST method with no referer header, POST method with no useragent header, Connection to IP address | suspicious_request | POST http://140.206.225.136:80/ | ||||||
| request | GET http://r.yx-s.net/b/duan/s/ginstall/?user_from=414100000225&user_channel=622110021&user_subsite=221121&mid=2d5bac7481e6a281dd071007abc25283&status=7&gkey=gjol&ver=1.0.0.1001&first_time= |
| request | GET http://gametool.down.yx-g.com/gametool/lyyx/gjol/622110021/DL.ini |
| request | GET http://gametool.down.360-g.net/gametool/lyyx/gjol/622110021/DL.ini |
| request | GET http://gametool.down.yx-g.com/gametool/lyyx/gjol/default/DL.ini |
| request | POST http://180.163.54.67:80/ |
| request | POST http://47.97.7.140:80/ |
| request | POST http://180.163.202.66:80/ |
| request | POST http://140.206.225.136:80/ |
| request | POST http://180.163.54.67:80/ |
| request | POST http://47.97.7.140:80/ |
| request | POST http://180.163.202.66:80/ |
| request | POST http://140.206.225.136:80/ |
| ip | 123.161.62.172 |
| ip | 180.163.202.93 |
| ip | 182.140.250.18 |
| ip | 39.98.93.220 |
| ip | 47.92.99.221 |
| regkey | .*360Safe |
| name | RT_VERSION | language | LANG_CHINESE | offset | 0x0044d168 | filetype | data | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | size | 0x000002e8 | ||||||||||||||||||
| name | RT_VERSION | language | LANG_CHINESE | offset | 0x0044d168 | filetype | data | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | size | 0x000002e8 | ||||||||||||||||||
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7za.exe |
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\download\atl71.dll |
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DlMgr.dll |
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\download\dl_peer_id.dll |
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\xldl.dll |
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\download\msvcr71.dll |
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\download\MiniThunderPlatform.exe |
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\download\minizip.dll |
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\download\XLBugHandler.dll |
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\download\XLBugReport.exe |
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\download\msvcp71.dll |
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\download\zlib1.dll |
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\download\download_engine.dll |
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7za.exe |
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\download\msvcr71.dll |
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\download\dl_peer_id.dll |
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\download\atl71.dll |
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\download\XLBugReport.exe |
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\download\XLBugHandler.dll |
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\download\MiniThunderPlatform.exe |
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\xldl.dll |
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\DlMgr.dll |
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\download\download_engine.dll |
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\download\zlib1.dll |
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\download\msvcp71.dll |
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\download\minizip.dll |
| Paloalto | generic.ml |
| Ikarus | Trojan.Agent |
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1620985513.238755 GetAdaptersAddresses |
flags:
0
family: 0 |
failed | 111 | 0 |
| entropy | 7.99551579620857 | section | {'size_of_data': '0x00283800', 'virtual_address': '0x001ca000', 'entropy': 7.99551579620857, 'name': '.rsrc', 'virtual_size': '0x002836dc'} | description | A section with a high entropy has been found | |||||||||
| entropy | 0.578167115902965 | description | Overall entropy of this PE file is high | |||||||||||
| host | 123.161.62.172 | |||
| host | 172.217.24.14 | |||
| host | 39.98.93.220 | |||
| process | bd6d5b27cc5e4c7efb580d603307a879.exe | useragent | Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)youxi | ||||||
| process | bd6d5b27cc5e4c7efb580d603307a879.exe | useragent | Mozila/4.0 (compatible; MSIE 5.0; SAFEBOX) | ||||||
No hosts contacted.
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 49185 | 124.225.165.197 gametool.down.yx-g.com | 80 |
| 192.168.56.101 | 49186 | 124.225.165.197 gametool.down.yx-g.com | 80 |
| 192.168.56.101 | 49187 | 124.225.165.197 gametool.down.yx-g.com | 80 |
| 192.168.56.101 | 49196 | 140.206.225.136 hubstat.hz.sandai.net | 80 |
| 192.168.56.101 | 49191 | 180.163.202.66 hub5pr.hz.sandai.net | 80 |
| 192.168.56.101 | 49188 | 180.163.54.67 hub5c.hz.sandai.net | 80 |
| 192.168.56.101 | 49184 | 36.110.234.164 r.yx-s.net | 80 |
| 192.168.56.101 | 49189 | 47.97.7.140 pmap.hz.sandai.net | 80 |
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 49235 | 114.114.114.114 | 53 |
| 192.168.56.101 | 50002 | 114.114.114.114 | 53 |
| 192.168.56.101 | 50004 | 114.114.114.114 | 53 |
| 192.168.56.101 | 50534 | 114.114.114.114 | 53 |
| 192.168.56.101 | 51378 | 114.114.114.114 | 53 |
| 192.168.56.101 | 53237 | 114.114.114.114 | 53 |
| 192.168.56.101 | 53657 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56539 | 114.114.114.114 | 53 |
| 192.168.56.101 | 57756 | 114.114.114.114 | 53 |
| 192.168.56.101 | 57874 | 114.114.114.114 | 53 |
| 192.168.56.101 | 62318 | 114.114.114.114 | 53 |
| 192.168.56.101 | 65004 | 114.114.114.114 | 53 |
| 192.168.56.101 | 8493 | 123.161.62.172 | 8000 |
| 192.168.56.101 | 8493 | 180.163.202.93 hub5u.hz.sandai.net | 8000 |
| 192.168.56.101 | 8493 | 182.140.250.18 hub5pn.hz.sandai.net | 8000 |
| 192.168.56.101 | 50005 | 192.168.56.1 | 1900 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 51808 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 55368 | 224.0.0.252 | 5355 |
| URI | Data |
|---|---|
| http://180.163.54.67:80/ | POST / HTTP/1.1
Host: 180.163.54.67:80
Content-type: application/octet-stream
Content-Length: 204
Connection: Keep-Alive
=\x00\x00\x00\x01\x00\x00\x00\xc0\x00\x00\x00\xc6
\x95\x0b\xb9~\xe0\xa6\xc8W;
\xa62<\x165\xc2\xc3\xe5H\x17\x83\xa6K\xe7\xfa\x1c>\xef\x15\xa7\xe8\xac\xe3\x1e\x87\xe95\xd3\x0b\xbb\xc8\xc0 -\x92\xa7\x82\xba\x9f~\x06\xdbFK\x86\xa9P\x17\x11\x12\x01\xe0\\xda\xc5\x94\x16\xfd\xe4\xdfY\x96Gt\x94\xea\xa4\xa9\x01{W\x17\xea\xd2\xd4Lp{\xf7\xd0\xce!Vk\x80\xa6`\x0b\x8c
\xaa\xc1\xddJ\x86\xa8\xa0\xf4\x08t\x96\xcb\x16\xdfq!1\x9f1d\xd9\xdc\x0e\xf2\xb2\xd4\xb8\xeaw\xf6\xe6G\xb2)\x006\xb4\x87<\xddB\xc4=+\xb0t\x84t:w7\x01\x930|\x9b\x0f\x97\xa3i\xd6\xab\xfb\xdd=\xf43\x0b9EX*\xb6\x9fc>\x92\xeb\x10\xf8c\x0e?\xea\xea\x10\x13\x83N\xf5 |
| http://gametool.down.yx-g.com/gametool/lyyx/gjol/622110021/DL.ini | GET /gametool/lyyx/gjol/622110021/DL.ini HTTP/1.1 Accept: */* User-Agent: Mozila/4.0 (compatible; MSIE 5.0; SAFEBOX) Host: gametool.down.yx-g.com Cache-Control: no-cache |
| http://47.97.7.140:80/ | POST / HTTP/1.1 Host: 47.97.7.140:80 Content-type: application/octet-stream Content-Length: 92 Connection: Keep-Alive @\x00\x00\x00\x03\x00\x00\x00P\x00\x00\x00\xbb\xcf\xe8aV\xf5\x1eJ\xd3\xad\x8e\xd6\x9e\xff\x01\xe5(\xfd\x82\x10\xbb\x98\x0f\xef\x8e\x1dR\xa9\xf8Es \x96\xc8\xb8\x15\xf6\xd3\xc2\x1a6\xa5Hn\xe4\xca-?\x0cjq\x87\xef\x91\xfc\xeb\xf6\xdd\xb7\xe1\x81\xc3\x1cs\x14\xa8b\xb3\xa9\x89m\xdb\x1b%\xc3\xfdS\x19\xaa\xff |
| http://gametool.down.yx-g.com/gametool/lyyx/gjol/default/DL.ini | GET /gametool/lyyx/gjol/default/DL.ini HTTP/1.1 Accept: */* User-Agent: Mozila/4.0 (compatible; MSIE 5.0; SAFEBOX) Host: gametool.down.yx-g.com Cache-Control: no-cache |
| http://180.163.202.66:80/ | POST / HTTP/1.1 Host: 180.163.202.66:80 Content-type: application/octet-stream Content-Length: 44 Connection: Keep-Alive A\x00\x00\x00\x05\x00\x00\x00 \x00\x00\x00\x96\xff=\xc2v?\xfabmg\x91\xd8Ex\x02\xacT\x15\xe7\xae\xe9\xb49\x1f\xce\x8c\x93\x11Z\x97\xc9\x15 |
| http://r.yx-s.net/b/duan/s/ginstall/?user_from=414100000225&user_channel=622110021&user_subsite=221121&mid=2d5bac7481e6a281dd071007abc25283&status=7&gkey=gjol&ver=1.0.0.1001&first_time= | GET /b/duan/s/ginstall/?user_from=414100000225&user_channel=622110021&user_subsite=221121&mid=2d5bac7481e6a281dd071007abc25283&status=7&gkey=gjol&ver=1.0.0.1001&first_time= HTTP/1.1 Accept: Accept: */* Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)youxi Host: r.yx-s.net Cache-Control: no-cache |
| http://140.206.225.136:80/ | POST / HTTP/1.1 Host: 140.206.225.136:80 Content-type: application/octet-stream Content-Length: 108 Connection: Keep-Alive <\x00\x00\x00\x0b\x00\x00\x00`\x00\x00\x00\xde\xbbEH\x8d\x13\xee\xedm\x06\xc5\x84\xa2\x00&I\xc2\x1a\xe0@\x11b\xd4\xa1|\xc7\xe0O'\xaf\xb7\x99\x9f\xd1\xc8\x18\x12\xef\xcc\xea\xdc\xdf\x8b\x1b\xa3\x0b\x0e\x04iA\xd7.\xd7\x16\xef\xd9e\xa92R\xc2\xec<\xa5(Uz\x83\xe3\x9f\xcaa\xae\xd24: \x0bk@\x0e\x9b\xd6z\xd2\x12\xe67\x01\xea\xb76\x0f\xdb\x8a\x06 |
| http://gametool.down.360-g.net/gametool/lyyx/gjol/622110021/DL.ini | GET /gametool/lyyx/gjol/622110021/DL.ini HTTP/1.1 Accept: */* User-Agent: Mozila/4.0 (compatible; MSIE 5.0; SAFEBOX) Host: gametool.down.360-g.net Cache-Control: no-cache |
No ICMP traffic performed.
No IRC requests performed.
No Suricata Alerts
No Suricata TLS
No Snort Alerts