SmartHawk

7.8

高危

55 个模型检测该样本为恶意！

重新分析

下载样本

84a066f7294211d47a88b38b0ad9ff2f0e385973c4a3b92b39b2df25e178aca8

cf90040c1233dfa02f3b5a0f85251243.exe

分析耗时

79s

最近分析

文件大小

780.0KB

静态报毒动态报毒 AGEN AGENTTESLA AI SCORE=86 ATTRIBUTE BUHVNF CONFIDENCE EQMN FAREIT GDSDA GENERICKD GENKRYPTIK HIGH CONFIDENCE HIGHCONFIDENCE HTDDNZ IGENT KILLPROC2 KRYPT KRYPTIK MALICIOUS PE MALWARE@#25IH6RFGTL4YN MALWAREX REMCOS SCORE TCLS UNSAFE USXVPHH20 WACATAC WMW@AAU1LDJI ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FYL!CF90040C1233	20200924	6.0.6.653
Alibaba	Backdoor:Win32/GenKryptik.613c4f5b	20190527	0.3.0.5
Avast	Win32:MalwareX-gen [Trj]	20200924	18.4.3895.0
Baidu		20190318	1.0.0.2
Kingsoft		20200924	2013.8.14.323
Tencent	Msil.Trojan.Crypt.Tcls	20200924	1.0.0.1
CrowdStrike	win/malicious_confidence_80% (W)	20190702	1.0

Checks if process is being debugged by a debugger (4 个事件)

Time & API	Arguments	Status	Return	Repeated
1619910846.401343 IsDebuggerPresent		failed	0	0
1619910846.417343 IsDebuggerPresent		failed	0	0
1619917000.97725 IsDebuggerPresent		failed	0	0
1619917000.97725 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619910846.432343 GlobalMemoryStatusEx		success	1	0

Connects to a Dynamic DNS Domain (4 个事件)

domain	salespaul.ddns.net
domain	nakamuraa.ddns.net
domain	nakamura.hopto.org
domain	salespaul.hopto.org

Allocates read-write-execute memory (usually to unpack itself) (50 out of 52 个事件)

Time & API	Arguments	Status
1619910845.542343 NtAllocateVirtualMemory	process_identifier: 2616 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00330000	success
1619910845.542343 NtAllocateVirtualMemory	process_identifier: 2616 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00360000	success
1619910846.042343 NtAllocateVirtualMemory	process_identifier: 2616 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x022f0000	success
1619910846.042343 NtAllocateVirtualMemory	process_identifier: 2616 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02440000	success
1619910846.198343 NtProtectVirtualMemory	process_identifier: 2616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e71000	success
1619910846.401343 NtAllocateVirtualMemory	process_identifier: 2616 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x004f0000	success
1619910846.401343 NtAllocateVirtualMemory	process_identifier: 2616 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00510000	success
1619910846.417343 NtAllocateVirtualMemory	process_identifier: 2616 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0049a000	success
1619910846.417343 NtProtectVirtualMemory	process_identifier: 2616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e72000	success
1619910846.417343 NtAllocateVirtualMemory	process_identifier: 2616 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00492000	success
1619910846.573343 NtAllocateVirtualMemory	process_identifier: 2616 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004a2000	success
1619910846.651343 NtAllocateVirtualMemory	process_identifier: 2616 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004c5000	success
1619910846.651343 NtAllocateVirtualMemory	process_identifier: 2616 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004cb000	success
1619910846.651343 NtAllocateVirtualMemory	process_identifier: 2616 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004c7000	success
1619910846.745343 NtAllocateVirtualMemory	process_identifier: 2616 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004a3000	success
1619910846.761343 NtAllocateVirtualMemory	process_identifier: 2616 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004a4000	success
1619910846.776343 NtAllocateVirtualMemory	process_identifier: 2616 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004ac000	success
1619910846.823343 NtAllocateVirtualMemory	process_identifier: 2616 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00710000	success
1619910847.011343 NtAllocateVirtualMemory	process_identifier: 2616 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004a5000	success
1619910847.089343 NtAllocateVirtualMemory	process_identifier: 2616 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b6000	success
1619910847.292343 NtAllocateVirtualMemory	process_identifier: 2616 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004ba000	success
1619910847.292343 NtAllocateVirtualMemory	process_identifier: 2616 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b7000	success
1619910847.682343 NtAllocateVirtualMemory	process_identifier: 2616 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02441000	success
1619910848.245343 NtAllocateVirtualMemory	process_identifier: 2616 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004a6000	success
1619910848.573343 NtAllocateVirtualMemory	process_identifier: 2616 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00711000	success
1619910848.682343 NtAllocateVirtualMemory	process_identifier: 2616 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x024c0000	success
1619917000.91525 NtAllocateVirtualMemory	process_identifier: 2200 region_size: 1835008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00a50000	success
1619917000.91525 NtAllocateVirtualMemory	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00bd0000	success
1619917000.96225 NtAllocateVirtualMemory	process_identifier: 2200 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00530000	success
1619917000.96225 NtAllocateVirtualMemory	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b0000	success
1619917000.96225 NtProtectVirtualMemory	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e71000	success
1619917000.97725 NtAllocateVirtualMemory	process_identifier: 2200 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02330000	success
1619917000.97725 NtAllocateVirtualMemory	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x024c0000	success
1619917000.97725 NtAllocateVirtualMemory	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ba000	success
1619917000.97725 NtProtectVirtualMemory	process_identifier: 2200 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e72000	success
1619917000.97725 NtAllocateVirtualMemory	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b2000	success
1619917001.02425 NtAllocateVirtualMemory	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00492000	success
1619917001.02425 NtAllocateVirtualMemory	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b5000	success
1619917001.02425 NtAllocateVirtualMemory	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004bb000	success
1619917001.02425 NtAllocateVirtualMemory	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b7000	success
1619917001.05525 NtAllocateVirtualMemory	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00493000	success
1619917001.05525 NtAllocateVirtualMemory	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00494000	success
1619917001.05525 NtAllocateVirtualMemory	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0049c000	success
1619917001.05525 NtAllocateVirtualMemory	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005a0000	success
1619917001.11825 NtAllocateVirtualMemory	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00495000	success
1619917001.11825 NtAllocateVirtualMemory	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004a6000	success
1619917001.14925 NtAllocateVirtualMemory	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004aa000	success
1619917001.14925 NtAllocateVirtualMemory	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004a7000	success
1619917001.49325 NtAllocateVirtualMemory	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b1000	success
1619917001.86825 NtAllocateVirtualMemory	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00496000	success

A process attempted to delay the analysis task. (1 个事件)

description

RegAsm.exe tried to sleep 187 seconds, actually delayed analysis time by 187 seconds

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.8948281257118325

section

{'size_of_data': '0x0009a200', 'virtual_address': '0x00002000', 'entropy': 7.8948281257118325, 'name': '.text', 'virtual_size': '0x0009a1c4'}

description

A section with a high entropy has been found

entropy

0.790891597177678

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619910849.104343 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0
1619917002.49325 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Manipulates memory of a non-child process indicative of process injection (9 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2200 manipulating memory of non-child process 2620
Process injection	Process 2200 manipulating memory of non-child process 2868
Process injection	Process 2200 manipulating memory of non-child process 3096
1619917002.05525 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000264 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619917002.05525 NtAllocateVirtualMemory	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000264 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000b0000	success	0	0
1619917002.18025 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000278 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619917002.18025 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000278 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000b0000	success	0	0
1619917002.30525 NtAllocateVirtualMemory	process_identifier: 3096 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000284 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000a0000	success	0	0
1619917002.30525 NtAllocateVirtualMemory	process_identifier: 3096 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000284 allocation_type: 4096 (MEM_COMMIT) base_address: 0x000b0000	success	0	0

Creates a windows hook that monitors keyboard input (keylogger) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619916998.1485 SetWindowsHookExA	thread_identifier: 0 callback_function: 0x00405194 module_address: 0x00000000 hook_identifier: 13 (WH_KEYBOARD_LL)	success	65985	0

Attempts to remove evidence of file being downloaded from the Internet (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Bin1:Zone.Identifier

Generates some ICMP traffic

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

216.165.226.49:24005

File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 个事件)

Elastic	malicious (high confidence)
DrWeb	Trojan.KillProc2.11372
MicroWorld-eScan	Trojan.GenericKD.43678852
FireEye	Generic.mg.cf90040c1233dfa0
CAT-QuickHeal	Trojan.Multi
Qihoo-360	Generic/Trojan.21a
McAfee	Fareit-FYL!CF90040C1233
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Trojan ( 0056081c1 )
Alibaba	Backdoor:Win32/GenKryptik.613c4f5b
K7GW	Trojan ( 0056081c1 )
Cybereason	malicious.3d4782
Arcabit	Trojan.Generic.D29A7C84
Invincea	Mal/Generic-S
BitDefenderTheta	Gen:NN.ZemsilF.34254.WmW@aaU1lDji
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/GenKryptik.EQMN
TrendMicro-HouseCall	Trojan.Win32.WACATAC.USXVPHH20
Avast	Win32:MalwareX-gen [Trj]
ClamAV	Win.Malware.Score-7597125-0
Kaspersky	HEUR:Trojan.MSIL.Crypt.gen
BitDefender	Trojan.GenericKD.43678852
NANO-Antivirus	Trojan.Win32.Crypt.htddnz
Paloalto	generic.ml
Ad-Aware	Trojan.GenericKD.43678852
Emsisoft	Trojan.GenericKD.43678852 (B)
Comodo	Malware@#25ih6rfgtl4yn
F-Secure	Heuristic.HEUR/AGEN.1116674
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Trojan.Win32.WACATAC.USXVPHH20
McAfee-GW-Edition	BehavesLike.Win32.Generic.bc
SentinelOne	DFI - Malicious PE
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.Krypt
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1116674
Antiy-AVL	Trojan/MSIL.Crypt
Microsoft	Trojan:MSIL/AgentTesla.AM!MTB
AegisLab	Trojan.MSIL.Crypt.4!c
ZoneAlarm	HEUR:Trojan.MSIL.Crypt.gen
GData	Trojan.GenericKD.43678852
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Kryptik.C3553714
ALYac	Trojan.GenericKD.43678852
Malwarebytes	Backdoor.Remcos
APEX	Malicious
Tencent	Msil.Trojan.Crypt.Tcls
Yandex	Trojan.Igent.bUhVnF.5
MAX	malware (ai score=86)

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-17 04:49:45

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
salespaul.ddns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
salespaul.hopto.org
nakamuraa.ddns.net
nakamura.hopto.org	A 216.165.226.49	216.165.226.49
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	57874	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.