52破解远控

酒醒寂寞饮小雨

原帖：http://www.52pojie.cn/thread-580924-1-1.html
样本：http://pan.baidu.com/s/1qYhh3QW  
解压密码 52pojie

AVAST加强模式拦截,虚拟机测试.

电脑发烧友

Eset小粉絲

[mw_shl_code=css,true]


Type:        File
Source:        C:\Users\Ivan\Downloads\muma\bass.dll
Status:        Infected
Quarantine object:        0085d414.qua
Restored:        NO
Uploaded to Avira:        NO
Operating system:        Windows XP/VISTA Workstation/Windows 7
Search engine:        8.03.42.182
Virus definition file:        8.12.155.142
Detection:        HEUR/APC (Cloud)
Date/Time:        18/2/2017, 17:33[/mw_shl_code]

18/2/2017, 5:30:52 PM [Real-Time Protection] Malware found
        The pattern of 'TR/Venik.eanh [trojan]'
        detected in file 'C:\Users\Ivan\Downloads\muma\Setting.ini'.
        Action performed: Move file to quarantine

18/2/2017, 5:30:51 PM [Real-Time Protection] Malware found
        The pattern of 'TR/Muldrop.wyino [trojan]'
        detected in file 'C:\Users\Ivan\Downloads\muma\date.ini'.
        Action performed: Move file to quarantine

skyboybone

你看我头像

诺顿：
bass.dll:  Heur. AdvML.C
aplayer.exe:  Suspicious.Cloud.7.F
setting.ini:  Trojan.Gen
data.ini:  Trojan.Gen

vm001

电脑发烧友 发表于 2017-2-18 17:32

关键的东西系没报啊
APlayer.dll实际是exe，去加载bass.dll这个dll是黑的
服务端用的是阿里云

电脑发烧友

vm001 发表于 2017-2-18 18:59
关键的东西系没报啊
APlayer.dll实际是exe，去加载bass.dll这个dll是黑的
服务端用的是阿里云

话说杀掉的那两个东西是干啥的？

vm001

电脑发烧友 发表于 2017-2-19 08:35
话说杀掉的那两个东西是干啥的？

不知道啊，不会分析

轩夏

MSE 断网
date.ini
Infected: Trojan:Win32/Dynamer!ac
Setting.ini
Infected: Trojan:Win32/Bulta!rfn
Setting.ini->(VFS:1714364.dll)
Infected: Backdoor:Win32/Venik!rfn [non_writable_container]

Dolby123

avast