{"id":"0f4f5b9c26d16a8594b8bca526b824a8","title":".NET Loader (AMSI Bypass + .su C2) — .NET Loader (AMSI Bypass + .su C2) · 木马/恶意软件 · PE32/PE64","md5":"0f4f5b9c26d16a8594b8bca526b824a8","sha256":"32dffaea1d2a0713f83910f760ec3ad0562555ff2c2f4bb7edf5c3c0a37c7b89","family":".NET Loader (AMSI Bypass + .su C2)","apt":null,"verdict":null,"sample_type":"木马/恶意软件","lang":"C#","file_format":"PE32/PE64","compiler":".NET","published_at":"2026-08-05T16:00:00.000Z","summary":"该样本为 .NET PE64 恶意加载器 (425KB)，技术含量极高：(1) AMSI 绕过: 通过 amsi.dll AmsiScanBuffer 禁用反恶意软件扫描接口，使恶意载荷不被检测；(2) ETW 补丁: 通过 ntdll.dll EtwEventWrite 禁用 Windows 事件跟踪，隐藏恶意行为；(3) 注册表持久化: 伪装为 RuntimeBroker (Base64: 'Microsoft\\\\RuntimeBroker')，写入 Run 键 (Base64: 'Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run') 和 SyncService；(4) C2 通信: 发现 .su TLD 域名 (p4c.su, +.su)，C2 字符串 ('C2', 'CTC2:')；(5) 加密载荷: keyObf/ivObf/keyMask/ivMask 混淆密钥，CryptoStreamMode/CipherMode/PaddingMode 加密配置；(6) 动态加载: payload + Load + Invoke + Thread + Marshal 反射加载。公司名 'Loader' 和 Assembly 名 'MyApplication.app' 是恶意软件典型命名。","url":"https://zseceye.com/report/0f4f5b9c26d16a8594b8bca526b824a8","json_url":"https://zseceye.com/report/0f4f5b9c26d16a8594b8bca526b824a8.json","html_url":"https://zseceye.com/report/0f4f5b9c26d16a8594b8bca526b824a8","hash_urls":{"md5":"https://zseceye.com/hash/0f4f5b9c26d16a8594b8bca526b824a8","sha256":"https://zseceye.com/hash/32dffaea1d2a0713f83910f760ec3ad0562555ff2c2f4bb7edf5c3c0a37c7b89"},"search_urls":{"md5":"https://zseceye.com/?q=0f4f5b9c26d16a8594b8bca526b824a8","sha256":"https://zseceye.com/?q=32dffaea1d2a0713f83910f760ec3ad0562555ff2c2f4bb7edf5c3c0a37c7b89"},"sample_download_url":"https://zseceye.com/report/0f4f5b9c26d16a8594b8bca526b824a8/sample","sample_filename":"32dffaea.zip","iocs":[],"ips":[]}