内容仅以原始语言提供
class="post-article">
Loader C/C++ 自2024年起活跃

ResourceDropper

PE64 resource dropper. FindResourceA+LoadResource+LockResource payload extraction from PE resource section. InternetOpenA+InternetOpenUrlA HTTP second-stage download. CryptGenRandom random filename for AV evasion. CreateProcessA payload execution.

威胁档案
类型 Loader
编程语言C/C++
C2协议HTTP
首次发现2024
目标 Küresel
用途 / 能力
  • PE Resource Dropper
尚未发现该家族的 C2 服务器。

研究报告 (1)

Orta

ResourceDropper 9ef1cd4c -- FindResourceA LoadResource LockResource PE Gizli Kaynak Paylod, InternetOpenA InternetOpenUrlA HTTP Indirme, CryptAcquireContextA CryptGenRandom Rastgele Dosya Adi | Orta

ResourceDropper 9ef1cd4c PE32+ x64 141KB. FindResourceA+LoadResource+LockResource PE kaynak payload. InternetOpenA+InternetOpenUrlA HTTP indirme. CryptAcquireContextA+CryptGenRandom rastgele dosya adi. CreateProcessA.

阅读报告 →