#Suspicious exe program# （2020-8-20）

川建国代理人

https://app.any.run/tasks/67685e0f-4c41-47f7-ae28-9effbb6e4288/ 搬运
https://any.run/report/26626cdbcc94c7e1c1aa6dd91624c9f0648af20d03c9cd358d6ea1734ceffbbb/67685e0f-4c41-47f7-ae28-9effbb6e4288 文本资源策划
蓝奏云：https://www.lanzoux.com/iHwvjfuj08h
IOC:

1. Main object- "AutoBuilderV3.9.exe"
   
2.         sha256        26626cdbcc94c7e1c1aa6dd91624c9f0648af20d03c9cd358d6ea1734ceffbbb       
   
3.         sha1        2f3f040f5af84a302821a470861139fe98715b60       
   
4.         md5        a96a1aa1342c6923486a79a08a794796       
   
5. DNS requests
   
6.         domain        icanhazip.com       
   
7.         domain        nusumu.wtf       
   
8. Connections
   
9.         ip        116.202.55.106       
   
10.         ip        116.202.244.153       
    
11.         ip        172.67.214.70       
    
12. HTTP/HTTPS requests
    
13.         url        http://icanhazip.com/       
    

复制代码

TEXT  ERPORT:

1. General Info
   
2. File name
   
3. AutoBuilderV3.9.exe
   
4. Full analysis https://app.any.run/tasks/67685e0f-4c41-47f7-ae28-9effbb6e4288
   
5. Verdict Malicious activity
   
6. Analysis date 8/20/2020, 06:56:14
   
7. OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
   
8. Tags: evasion
   
9. Indicators:
   
10. 
    
11. MIME: application/x-dosexec
    
12. File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
    
13. MD5
    
14. A96A1AA1342C6923486A79A08A794796
    
15. SHA1
    
16. 2F3F040F5AF84A302821A470861139FE98715B60
    
17. SHA256
    
18. 26626CDBCC94C7E1C1AA6DD91624C9F0648AF20D03C9CD358D6EA1734CEFFBBB
    
19. SSDEEP
    
20. 6144:XLKXQQTDJXPBMDVXEHNBMCDSGKTFSPO+NZHUVFIQBIFW4F4CNVFO5/KPNLBCBQMA:XZUMZEHN4TAUPIVF+UNLPCFFTIQYSK

复制代码

a233

AhnLab

黑暗在翻腾

卡巴斯基断网双击PDM杀

anthonyqian

诺顿 B杀
卡巴 HEUR:Trojan.MSIL.Agent.gen

lenovo2019用户

大蜘蛛对象: AutoBuilderV3.9.bin 威胁: Trojan.PWS.Siggen2.51763

henry217

mcafee占位

McAfee Internet Security kill

lajizandian

AVG 解压杀

浪里个浪9527

小红伞

WAR314159

ESET KILL

1. 时间;扫描程序;对象类型;对象;检测;操作;用户;信息;哈希;此处首次所见
   
2. 2020/8/20 18:53:52;文件系统实时防护;文件;C:\Users\周华鑫\AppData\Local\Temp\BNZ.5f3e563a4c4185c\AutoBuilderV3.9.bin;MSIL/Spy.Agent.CTU 特洛伊木马 的变种;通过删除清除;DESKTOP-PTTR5MT\周华鑫;在应用程序新建的文件上发生事件: C:\Program Files\Bandizip\Bandizip.exe (103F35C2A271F39642571BC73D10C3EEB1D91B39).;2F3F040F5AF84A302821A470861139FE98715B60;2020/8/20 13:02:42
   

复制代码

浪里个浪9527