{"id":"f89cad44baf7b71f0546119d74f45d1b","title":"HTTPS_Downloader_Baltos — HTTPS_Downloader_Baltos · 木马/恶意软件 · PE64","md5":"f89cad44baf7b71f0546119d74f45d1b","sha256":"971ca31a18582eed3b1ddfe11533d698a9d3a2b5027a591cde01f7cfaa2d7cc9","family":"HTTPS_Downloader_Baltos","apt":null,"verdict":null,"sample_type":"木马/恶意软件","lang":"C++","file_format":"PE64","compiler":"MinGW-w64","published_at":"2026-08-07T16:00:00.000Z","summary":"该样本是一款由 MinGW-w64 (GCC) 编译的 x64 Windows 下载器/加载器，核心功能：HTTPS C2 通信：使用 WinHTTP API 连接 dallas.baltos.online:8443，下载加密 payload (/payload/18c8255e77bf0387.bin)。伪装 User-Agent 为 Mozilla/5.0 浏览器。AES 解密：CAPA 检测到 AES 常量，解密下载的载荷。进程注入：通过 WriteProcessMemory 注入解密后的载荷到目标进程。反检测：包含反检测检查逻辑，XOR 混淆字符串，动态解析 API。","url":"https://zseceye.com/report/f89cad44baf7b71f0546119d74f45d1b","json_url":"https://zseceye.com/report/f89cad44baf7b71f0546119d74f45d1b.json","html_url":"https://zseceye.com/report/f89cad44baf7b71f0546119d74f45d1b","hash_urls":{"md5":"https://zseceye.com/hash/f89cad44baf7b71f0546119d74f45d1b","sha256":"https://zseceye.com/hash/971ca31a18582eed3b1ddfe11533d698a9d3a2b5027a591cde01f7cfaa2d7cc9"},"search_urls":{"md5":"https://zseceye.com/?q=f89cad44baf7b71f0546119d74f45d1b","sha256":"https://zseceye.com/?q=971ca31a18582eed3b1ddfe11533d698a9d3a2b5027a591cde01f7cfaa2d7cc9"},"sample_download_url":"https://zseceye.com/report/f89cad44baf7b71f0546119d74f45d1b/sample","sample_filename":"971ca31a18582eed.zip","iocs":[],"ips":[]}