{"id":"f3cbdffbf6bfc26fe09f95e88b188c09","title":"QQ盗号木马 (Shellex) — QQ盗号木马 (Shellex) · 木马/恶意软件 · PE32","md5":"f3cbdffbf6bfc26fe09f95e88b188c09","sha256":"1c659cbf8f73b2dd0ed8238595c225dbc1e87d5ea538c24a5d52faf0f4a49e7d","family":"QQ盗号木马 (Shellex)","apt":null,"verdict":null,"sample_type":"木马/恶意软件","lang":"C++","file_format":"PE32","compiler":"MSVC 6.0 MFC","published_at":"2020-02-24T16:00:00.000Z","summary":"该样本是一个QQ盗号木马，伪装为合法 Windows 服务 (导出名: Shellex)。 编译于 2018年4月，使用 Visual C++ 6.0 和 MFC 4.2 库，采用 Winsock 套接字进行网络通信。 核心行为：(1) 注册为 Windows 服务 (ADVAPI32 StartServiceCtrlDispatcherA)；(2) 通过 HTTP 端口 80 查询 QQ 空间 API (users.qzone.qq.com) 获取用户头像； (3) 使用 Winsock (WS2_32) 进行 C2 通信 (socket/connect/send/recv)；(4) 实现服务持久化 (SetServiceStatus/RegisterServiceCtrlHandlerA)； (5) 文件系统操作 (CopyFileA/MoveFileExA/CreateDirectoryA)。 存在两个变种 (SHA256前缀: 1c659cbf, ecb05f56)，编译时间、大小、导入表完全一致。","url":"https://zseceye.com/report/f3cbdffbf6bfc26fe09f95e88b188c09","json_url":"https://zseceye.com/report/f3cbdffbf6bfc26fe09f95e88b188c09.json","html_url":"https://zseceye.com/report/f3cbdffbf6bfc26fe09f95e88b188c09","hash_urls":{"md5":"https://zseceye.com/hash/f3cbdffbf6bfc26fe09f95e88b188c09","sha256":"https://zseceye.com/hash/1c659cbf8f73b2dd0ed8238595c225dbc1e87d5ea538c24a5d52faf0f4a49e7d"},"search_urls":{"md5":"https://zseceye.com/?q=f3cbdffbf6bfc26fe09f95e88b188c09","sha256":"https://zseceye.com/?q=1c659cbf8f73b2dd0ed8238595c225dbc1e87d5ea538c24a5d52faf0f4a49e7d"},"sample_download_url":"https://zseceye.com/report/f3cbdffbf6bfc26fe09f95e88b188c09/sample","sample_filename":"1c659cbf.zip","iocs":[],"ips":[]}