{"id":"89a36b401a7b2c1c6264527cc18da6a9","title":"WinHTTP 下载器变种 — WinHTTP 下载器变种 · 木马/恶意软件 · PE64","md5":"89a36b401a7b2c1c6264527cc18da6a9","sha256":"023158a37cbae730c63eee626a396dc22f305ace61471498e13b4b1f36356502","family":"WinHTTP 下载器变种","apt":null,"verdict":null,"sample_type":"木马/恶意软件","lang":"未知","file_format":"PE64","compiler":"MSVC 2022","published_at":"2026-08-09T16:00:00.000Z","summary":"该样本是样本 00cc775f 的变种，同属 WinHTTP 下载器家族。使用 XOR 密钥 0xa7（变种 #1 使用 0x8e）加密所有字符串和 API 名称。通过 WinHTTP 从 hxxps://zewaplus[.]club/files/telemetriawork/telepuz.dll 下载 DLL 载荷，保存至 %APPDATA%\\AelvarNetworks\\Ledger\\hlmzone.dll，并通过 rundll32.exe 以 InstallModule 导出函数执行。反分析技术使用 NETAPI32.NetApiBufferFree + WINMM.timeGetTime 替代原版的 USERENV + MPR DLL。其余核心逻辑（动态 API 解析、rdtsc 反调试、WinHTTP 下载器）与变种 #1 完全一致。","url":"https://zseceye.com/report/89a36b401a7b2c1c6264527cc18da6a9","json_url":"https://zseceye.com/report/89a36b401a7b2c1c6264527cc18da6a9.json","html_url":"https://zseceye.com/report/89a36b401a7b2c1c6264527cc18da6a9","hash_urls":{"md5":"https://zseceye.com/hash/89a36b401a7b2c1c6264527cc18da6a9","sha256":"https://zseceye.com/hash/023158a37cbae730c63eee626a396dc22f305ace61471498e13b4b1f36356502"},"search_urls":{"md5":"https://zseceye.com/?q=89a36b401a7b2c1c6264527cc18da6a9","sha256":"https://zseceye.com/?q=023158a37cbae730c63eee626a396dc22f305ace61471498e13b4b1f36356502"},"sample_download_url":"https://zseceye.com/report/89a36b401a7b2c1c6264527cc18da6a9/sample","sample_filename":"023158a37cbae730.zip","iocs":[],"ips":[]}