6.8
高危
55 个模型检测该样本为恶意！
重新分析
更多

d85497f61b07d8f8cc30c3c66ab21883a0274c7a3e7bc982a3a622ca2eed39a4

c5a86a4a3099d907967d739d5d6f5436.exe

分析耗时

103s

最近分析

文件大小

50.5KB
静态报毒 动态报毒 100% 9WLRK8BWVOYYE4CH4RHQGQ AI SCORE=100 CONFIDENCE DMW@A0FKFRI ELDORADO GDSDA GENERIC@ML GENERICRXCW GJXCIJG2VEK HDYMQC HIGH CONFIDENCE MALICIOUS PE MALWARE@#2BKLR4RBGQQR1 R066C0DHK20 RAZY RDMK REVENGE REVENGERAT REVETRAT SCORE SPYBOTNET STATIC AI SUSGEN TSCOPE UNSAFE WACATAC XPACK ZEMSILF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:MSIL/XPACK.5f67f52e 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20201229 21.1.5827.0
Tencent 20201229 1.0.0.1
Kingsoft 20201229 2017.9.26.565
McAfee GenericRXCW-KM!C5A86A4A3099 20201229 6.0.6.653
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
Queries for the computername (50 out of 62 个事件)
Time & API Arguments Status Return Repeated
1619937349.498126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937350.326126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937351.030126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937352.873126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937354.811126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937354.842126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937357.608126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937357.639126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937358.686126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937358.686126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937361.498126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937361.545126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937363.467126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937363.483126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937366.233126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937366.280126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937367.311126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937367.342126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937370.030126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937370.061126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937371.108126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937371.123126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937373.826126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937373.858126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937374.905126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937374.920126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937377.623126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937377.670126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937378.717126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937378.733126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937381.326126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937381.373126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937382.405126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937382.436126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937385.201126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937385.201126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937386.233126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937386.264126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937389.061126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937389.092126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937390.139126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937390.139126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937392.920126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937392.936126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937393.983126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937393.998126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937396.811126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937396.826126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937397.858126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619937397.889126
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (1 个事件)
Time & API Arguments Status Return Repeated
1619937346.795126
IsDebuggerPresent
failed 0 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619937354.780126
GlobalMemoryStatusEx
success 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)
section .sdata
行为判定
动态指标
Connects to a Dynamic DNS Domain (1 个事件)
domain maintop.duckdns.org
Allocates read-write-execute memory (usually to unpack itself) (39 个事件)
Time & API Arguments Status Return Repeated
1619937341.576126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 1572864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00800000
success 0 0
1619937341.576126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00940000
success 0 0
1619937346.670126
NtProtectVirtualMemory
process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73c51000
success 0 0
1619937346.811126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0044a000
success 0 0
1619937346.811126
NtProtectVirtualMemory
process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73c52000
success 0 0
1619937346.811126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00442000
success 0 0
1619937347.139126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00452000
success 0 0
1619937347.248126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00453000
success 0 0
1619937347.248126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0048b000
success 0 0
1619937347.248126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00487000
success 0 0
1619937347.264126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0045c000
success 0 0
1619937347.733126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00454000
success 0 0
1619937347.733126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00456000
success 0 0
1619937347.920126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008c0000
success 0 0
1619937347.983126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0047a000
success 0 0
1619937347.998126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00472000
success 0 0
1619937348.108126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008c1000
success 0 0
1619937348.233126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0046a000
success 0 0
1619937348.233126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00467000
success 0 0
1619937348.358126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008c4000
success 0 0
1619937348.358126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0045a000
success 0 0
1619937348.389126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00485000
success 0 0
1619937349.186126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0047c000
success 0 0
1619937349.264126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00457000
success 0 0
1619937349.420126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0044b000
success 0 0
1619937349.514126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x05080000
success 0 0
1619937349.608126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00466000
success 0 0
1619937349.623126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00443000
success 0 0
1619937350.670126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0045b000
success 0 0
1619937350.670126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x05110000
success 0 0
1619937350.686126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x05111000
success 0 0
1619937350.686126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x05112000
success 0 0
1619937350.717126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
base_address: 0x7ef30000
success 0 0
1619937350.717126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x7ef30000
success 0 0
1619937350.717126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x7ef30000
success 0 0
1619937350.717126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
base_address: 0x7ef20000
success 0 0
1619937350.717126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x7ef20000
success 0 0
1619937350.889126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x05081000
success 0 0
1619937354.780126
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008c5000
success 0 0
Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)
Time & API Arguments Status Return Repeated
1619937348.373126
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
Executes one or more WMI queries which can be used to identify virtual machines (1 个事件)
wmi select * from Win32_Processor
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Checks the CPU name from registry, possibly for anti-virtualization (2 个事件)
registry HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString
registry HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CENTRALPROCESSOR\0\ProcessorNameString
Executes one or more WMI queries (4 个事件)
wmi Select * from AntiVirusProduct
wmi select * from Win32_Processor
wmi select * from Win32_OperatingSystem
wmi SELECT * FROM FirewallProduct
File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Razy.609143
FireEye Generic.mg.c5a86a4a3099d907
Qihoo-360 Generic/Trojan.7c5
ALYac Gen:Variant.Razy.609143
Cylance Unsafe
K7AntiVirus Trojan ( 005121fb1 )
Alibaba Trojan:MSIL/XPACK.5f67f52e
K7GW Trojan ( 005121fb1 )
Cybereason malicious.a3099d
Arcabit Trojan.Razy.D94B77
Cyren W32/Trojan.BZI.gen!Eldorado
Symantec Trojan.Revetrat
APEX Malicious
Paloalto generic.ml
ClamAV Win.Trojan.RevengeRAT-6690354-0
Kaspersky HEUR:Trojan.MSIL.Generic
BitDefender Gen:Variant.Razy.609143
NANO-Antivirus Trojan.Win32.Razy.hdymqc
AegisLab Trojan.MSIL.Generic.4!c
Avast Win32:Trojan-gen
Ad-Aware Gen:Variant.Razy.609143
Sophos Mal/Generic-S
Comodo Malware@#2bklr4rbgqqr1
F-Secure Trojan.TR/Crypt.XPACK.Gen
DrWeb BackDoor.SpyBotNET.20
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R066C0DHK20
McAfee-GW-Edition BehavesLike.Win32.Generic.qm
Emsisoft Gen:Variant.Razy.609143 (B)
SentinelOne Static AI - Malicious PE
Avira TR/Crypt.XPACK.Gen
Antiy-AVL Trojan/Win32.Wacatac
Microsoft Backdoor:MSIL/Revetrat.VN!MTB
ZoneAlarm HEUR:Trojan.MSIL.Generic
GData Gen:Variant.Razy.609143
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.RL_Generic.C3451460
Acronis suspicious
McAfee GenericRXCW-KM!C5A86A4A3099
MAX malware (ai score=100)
VBA32 TScope.Trojan.MSIL
Malwarebytes Trojan.Crypt.MSIL.Generic
ESET-NOD32 a variant of MSIL/Agent.AZM
TrendMicro-HouseCall TROJ_GEN.R066C0DHK20
Rising Trojan.Generic@ML.100 (RDMK:9wlRk8BwvOyye4ch4RHqgQ)
Yandex Trojan.Agent!GJXcIjG2Vek
Ikarus Backdoor-Rat.Revenge
eGambit Trojan.Generic
Fortinet MSIL/Agent.AZM!tr
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 172.217.24.14:443
dead_host 172.217.160.78:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-02-26 03:28:45

Imports

Library mscoree.dll:
• 0x402000 _CorExeMain

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49180 192.169.69.25 maintop.duckdns.org 5540
192.168.56.101 49183 192.169.69.25 maintop.duckdns.org 5540
192.168.56.101 49184 192.169.69.25 maintop.duckdns.org 5540
192.168.56.101 49185 192.169.69.25 maintop.duckdns.org 5540
192.168.56.101 49186 192.169.69.25 maintop.duckdns.org 5540
192.168.56.101 49188 192.169.69.25 maintop.duckdns.org 5540
192.168.56.101 49189 192.169.69.25 maintop.duckdns.org 5540
192.168.56.101 49190 192.169.69.25 maintop.duckdns.org 5540
192.168.56.101 49191 192.169.69.25 maintop.duckdns.org 5540
192.168.56.101 49192 192.169.69.25 maintop.duckdns.org 5540
192.168.56.101 49193 192.169.69.25 maintop.duckdns.org 5540
192.168.56.101 49196 192.169.69.25 maintop.duckdns.org 5540
192.168.56.101 49197 192.169.69.25 maintop.duckdns.org 5540
192.168.56.101 49200 192.169.69.25 maintop.duckdns.org 5540
192.168.56.101 49201 192.169.69.25 maintop.duckdns.org 5540

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 57236 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 62912 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 53210 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.