组织分类：IAmTheKing 俄罗斯

类型：malware win32 RAT

md5:df43a1fcf641ee5c1b4b21f069aa93b0

sha256:23e7e0bbc36d523daa8e3cd8e32618c6c1fb61e32f664756e77d7917b3b11644

该程序由c++编写，进入主函数先进行了动态调用获取了几个函数地址

https://s3-us-west-2.amazonaws.com/secure.notion-static.com/facf2f47-8aec-4b6b-b9d7-56b457eef8cb/Untitled.png

https://s3-us-west-2.amazonaws.com/secure.notion-static.com/69cc08db-a0b7-4235-9f4b-ba10fed34e23/Untitled.png

通过注册表位置检测vmware和vbox虚拟机

https://s3-us-west-2.amazonaws.com/secure.notion-static.com/efecf807-921d-4699-932c-5d3ca7d79241/Untitled.png

https://s3-us-west-2.amazonaws.com/secure.notion-static.com/53684dfd-fee0-42bc-bb4e-ac48989d67b5/Untitled.png

https://s3-us-west-2.amazonaws.com/secure.notion-static.com/34a875e9-8972-4a97-ac16-4019764a3aca/Untitled.png

通过注册表检测virtualbox

https://s3-us-west-2.amazonaws.com/secure.notion-static.com/c5bcdc1e-7980-4b2b-bffc-ba4125c46e70/Untitled.png

获取网络名，主机名，用户名，版本

https://s3-us-west-2.amazonaws.com/secure.notion-static.com/b0b4c711-cf30-4095-93ec-a7ec6df5a138/Untitled.png

https://s3-us-west-2.amazonaws.com/secure.notion-static.com/d9594c84-b646-4758-a949-923faa6f3820/Untitled.png

通过api进行http 访问31.214.157.14，上传信息

https://s3-us-west-2.amazonaws.com/secure.notion-static.com/ec583ed9-0737-4e52-9709-d6865ba157da/Untitled.png

搜集信息完毕，启动线程，进行接下接收控制命令循环