{"id":"ac061db892ad8cd21a565996bdb33d5c","title":"ConfuserEx-.NET-Trojan — ConfuserEx-.NET-Trojan · 木马/恶意软件 · PE32","md5":"ac061db892ad8cd21a565996bdb33d5c","sha256":"135732f938ca6b6e1fd1974ba172665d3c474b5346e035ea24c37b03500fb4e9","family":"ConfuserEx-.NET-Trojan","apt":null,"verdict":null,"sample_type":"木马/恶意软件","lang":"C#","file_format":"PE32","compiler":".NET Framework v4.0","published_at":"2026-08-05T16:00:00.000Z","summary":"该样本为 .NET Framework v4.0 木马程序，使用 ConfuserEx v1.0.1 进行混淆保护。具备反调试能力（IsDebuggerPresent + NtQueryInformationProcess 双重检测），通过 Process.Start 执行任意进程（CreateNoWindow 隐藏窗口），内置 OLE DB 数据库连接能力（OleDbConnection/OleDbCommand），支持动态加载外部 .NET 程序集（Assembly.Load + AssemblyResolve），使用 Thread.Sleep 延迟执行对抗沙箱检测。嵌入加密资源（BKz#8$Bu'...resources），C2 配置和核心载荷可能存储其中。","url":"https://zseceye.com/report/ac061db892ad8cd21a565996bdb33d5c","json_url":"https://zseceye.com/report/ac061db892ad8cd21a565996bdb33d5c.json","html_url":"https://zseceye.com/report/ac061db892ad8cd21a565996bdb33d5c","hash_urls":{"md5":"https://zseceye.com/hash/ac061db892ad8cd21a565996bdb33d5c","sha256":"https://zseceye.com/hash/135732f938ca6b6e1fd1974ba172665d3c474b5346e035ea24c37b03500fb4e9"},"search_urls":{"md5":"https://zseceye.com/?q=ac061db892ad8cd21a565996bdb33d5c","sha256":"https://zseceye.com/?q=135732f938ca6b6e1fd1974ba172665d3c474b5346e035ea24c37b03500fb4e9"},"sample_download_url":"https://zseceye.com/report/ac061db892ad8cd21a565996bdb33d5c/sample","sample_filename":"135732f938ca6b6e.zip","iocs":[],"ips":[]}