{"id":"ce643c8ff7f688a91f69f150ff8a8c9f","title":"高级PE64植入体 (疑似CobaltStrike) — 高级PE64植入体 (疑似CobaltStrike) · 木马/恶意软件 · PE64","md5":"ce643c8ff7f688a91f69f150ff8a8c9f","sha256":"ed23e0d5d55c12998aea2e4d065726301cb02257f4c9435758368fb94c7881c9","family":"高级PE64植入体 (疑似CobaltStrike)","apt":"APT41/Winnti","verdict":null,"sample_type":"木马/恶意软件","lang":"未知","file_format":"PE64","compiler":"Stripped (自定义混淆)","published_at":"2026-08-04T16:00:00.000Z","summary":"该样本是一个高度混淆的PE64植入体，编译于2026-08-05（极近期），使用多层加密和高级反分析技术。 Ghidra反编译产出453KB伪C代码，识别172个函数。入口点立即创建互斥体(CreateMutexA)防止多实例。 核心能力 (CAPA 25+规则命中): 进程注入: CreateRemoteThread + WriteProcessMemory → T1055.003 线程执行劫持 反射加载: T1620 — 内存中加载PE载荷，绕过磁盘检测 多层加密: RC4 (KSA+PRGA) + Salsa20/ChaCha + XOR编码(10处) 栈字符串混淆: 每个字符串逐字节构建在栈上然后拼接 — Ghidra确认大量FUN_00424090调用 反调试: 反调试指令(2处匹配) + 栈字符串隐藏敏感数据 HTTP通信: HTTP头读取(3处匹配) — C2 over HTTPS 命名管道IPC: DisconnectNamedPipe — 进程间通信 系统探测: 窗口发现(T1010) + 系统信息(T1082) + 地理位置(T1614.001) 哈希算法: CRC32 + djb2 — 可能用于API名哈希解析 威胁评估: 该样本的技术栈(RC4/Salsa20/反射加载/栈字符串/进程注入)与CobaltStrike Beacon高度一致。.text段高熵(6.34)确认代码加密。 SHA256: ed23e0d5d55c12998aea2e4d065726301cb02257f4c9435758368fb94c7881c9","url":"https://zseceye.com/report/ce643c8ff7f688a91f69f150ff8a8c9f","json_url":"https://zseceye.com/report/ce643c8ff7f688a91f69f150ff8a8c9f.json","html_url":"https://zseceye.com/report/ce643c8ff7f688a91f69f150ff8a8c9f","hash_urls":{"md5":"https://zseceye.com/hash/ce643c8ff7f688a91f69f150ff8a8c9f","sha256":"https://zseceye.com/hash/ed23e0d5d55c12998aea2e4d065726301cb02257f4c9435758368fb94c7881c9"},"search_urls":{"md5":"https://zseceye.com/?q=ce643c8ff7f688a91f69f150ff8a8c9f","sha256":"https://zseceye.com/?q=ed23e0d5d55c12998aea2e4d065726301cb02257f4c9435758368fb94c7881c9"},"sample_download_url":"https://zseceye.com/report/ce643c8ff7f688a91f69f150ff8a8c9f/sample","sample_filename":"ed23e0d5.zip","iocs":[],"ips":[]}