{"id":"68adf0a596bb63131bc320b521e45016","title":".NET RAT (BSOD保护) — .NET RAT (BSOD保护) · 木马/恶意软件 · PE32 .NET","md5":"68adf0a596bb63131bc320b521e45016","sha256":"c3896171b744c28d8def5cb67f6f55db2c6383b6fd1d727c367c8fb54e981db9","family":".NET RAT (BSOD保护)","apt":null,"verdict":null,"sample_type":"木马/恶意软件","lang":"C#","file_format":"PE32 .NET","compiler":"VB.NET","published_at":"2026-08-04T16:00:00.000Z","summary":"该样本是一个.NET RAT，使用VB.NET编译，大小26.5 KB。其最显著的特征是使用了RtlSetProcessIsCritical API， 将自身标记为Windows关键进程 — 如果该进程被终止，Windows将立即蓝屏(BSOD)。 核心能力: BSOD自杀保护: RtlSetProcessIsCritical + ProcessCritical — 杀进程=蓝屏 凭据窃取: NetworkCredential + ICredentials — Windows网络凭据 注册表操纵: RegistryValueKind + RegistryKeyPermissionCheck — 持久化+系统篡改 进程管理: ProcessStartInfo + GetProcesses + GetCurrentProcess — 启动/枚举进程 网络配置: GetHostAddresses + CheckHostName + Ports — DNS解析+端口配置 单实例: MutexControl — 防止重复运行 SHA256: c3896171b744c28d8def5cb67f6f55db2c6383b6fd1d727c367c8fb54e981db9","url":"https://zseceye.com/report/68adf0a596bb63131bc320b521e45016","json_url":"https://zseceye.com/report/68adf0a596bb63131bc320b521e45016.json","html_url":"https://zseceye.com/report/68adf0a596bb63131bc320b521e45016","hash_urls":{"md5":"https://zseceye.com/hash/68adf0a596bb63131bc320b521e45016","sha256":"https://zseceye.com/hash/c3896171b744c28d8def5cb67f6f55db2c6383b6fd1d727c367c8fb54e981db9"},"search_urls":{"md5":"https://zseceye.com/?q=68adf0a596bb63131bc320b521e45016","sha256":"https://zseceye.com/?q=c3896171b744c28d8def5cb67f6f55db2c6383b6fd1d727c367c8fb54e981db9"},"sample_download_url":"https://zseceye.com/report/68adf0a596bb63131bc320b521e45016/sample","sample_filename":"c3896171.zip","iocs":[],"ips":[]}