内容仅以原始语言提供
class="post-article">
Botnet C 自2023年起活跃

SMBWorm

SMB worm with lateral movement. NetShareEnum + WNetGetConnectionW for SMB share enumeration. IcmpSendEcho for network host discovery. CryptStringToBinaryA for Base64 C2 address decoding. CoGetObject COM UAC bypass. Entropy 7.99 maximum packing.

威胁档案
类型 Botnet
编程语言C
C2协议TCP/SMB
首次发现2023
目标 Küresel
用途 / 能力
  • Lateral Movement/Worm
尚未发现该家族的 C2 服务器。

研究报告 (1)

Kritik

SMBWorm LBB_pass.bin -- NetShareEnum WNetGetConnectionW SMB Ag Paylasim Yayilma, IcmpSendEcho ICMP Ag Kesfi, CryptStringToBinaryA Base64 C2 Adres Decode, Entropi 7.99 Maksimum Paketleme, CoGetObject COM UAC Bypass | Kritik

SMBWorm LBB_pass.bin PE32 x86. NetShareEnum WNetGetConnectionW SMB ag paylasim yayilma. IcmpSendEcho ICMP ag kesfi. CryptStringToBinaryA Base64 C2 decode. Entropi 7.99 maksimum paketleme. CoGetObject COM UAC bypass.

阅读报告 →