{"id":"ab2b571a310e636260d8bfc041dd6bf5","title":"未知 .NET RAT — 未知 .NET RAT · 木马/恶意软件 · PE32 .NET","md5":"ab2b571a310e636260d8bfc041dd6bf5","sha256":"caaa5263db4330c246e82a67c5f0773c32478390644121a4555c90476bb526b8","family":"未知 .NET RAT","apt":null,"verdict":null,"sample_type":"木马/恶意软件","lang":"C#","file_format":"PE32 .NET","compiler":"VB.NET","published_at":"2020-02-24T16:00:00.000Z","summary":"该样本是一个 .NET 远程访问木马 (RAT)，使用 VB.NET 编译，编译于 2020-02-24 20:14:23。 虽然未被 DIE 明确识别为已知家族，但其导入的 System.Net.Sockets.TcpClient 和 Microsoft.Win32.RegistryProxy 明确指示了 RAT 功能: TCP C2 通信 + 注册表持久化。 引用 screen, opera, trust 表明具备屏幕监控和浏览器操作能力。 SHA256: caaa5263db4330c246e82a67c5f0773c...","url":"https://zseceye.com/report/ab2b571a310e636260d8bfc041dd6bf5","json_url":"https://zseceye.com/report/ab2b571a310e636260d8bfc041dd6bf5.json","html_url":"https://zseceye.com/report/ab2b571a310e636260d8bfc041dd6bf5","hash_urls":{"md5":"https://zseceye.com/hash/ab2b571a310e636260d8bfc041dd6bf5","sha256":"https://zseceye.com/hash/caaa5263db4330c246e82a67c5f0773c32478390644121a4555c90476bb526b8"},"search_urls":{"md5":"https://zseceye.com/?q=ab2b571a310e636260d8bfc041dd6bf5","sha256":"https://zseceye.com/?q=caaa5263db4330c246e82a67c5f0773c32478390644121a4555c90476bb526b8"},"sample_download_url":"https://zseceye.com/report/ab2b571a310e636260d8bfc041dd6bf5/sample","sample_filename":"caaa5263.zip","iocs":[],"ips":[]}