Stegoloader: A Stealthy Information Stealer

显示全部楼层 · 发表于 2015-6-19 21:58:14

http://www.secureworks.com/cyber ... nformation-stealer/

感谢Xylitol

http://yunpan.cn/cQm2y5MKp5fSV （提取码：2559）

密码 infected

显示全部楼层 · 发表于 2015-6-19 22:16:09

avg和管家扫描都认为安全

显示全部楼层 · 发表于 2015-6-19 22:28:57

mcafee 清空。
[mw_shl_code=css,true]6/19/2015 10:27:51 PM "E:\Virus\Stegoloader deployment module executable\0a58b98205c8542ae0516b4fe3ff8a4a6d6e9c199ec2d4e0de0aa8f9e1290328" "RDN/Generic.bfr!im" "2"

6/19/2015 10:27:54 PM "E:\Virus\Stegoloader deployment module executable\3167f5094756daff4d5dc6065876bdb8601ad1c1dda71f145ebf084125a2a37f" "W32/Worm-FVY!02E47D668BCE" "1"

6/19/2015 10:27:54 PM "E:\Virus\Stegoloader deployment module executable\34aa0f16d978a691f8c323b83cb14d8576177f427ff9c07953a7a4a648b9a8e6" "W32/Worm-FVW!A5EE3322263A" "1"

6/19/2015 10:27:54 PM "E:\Virus\Stegoloader deployment module executable\e3c5fb0b3ce641b7d91e63521645018ccf1bd73468f1919dab0434d06ff53deb" "RDN/Generic.dx!djj" "2"

6/19/2015 10:27:54 PM "E:\Virus\Stegoloader deployment module executable\1f8b5985c0e915ef6826693f21d05dab0e2d4645713c5eec66007f9a1d9e256b" "Artemis!4598CDDAD400" "2"

6/19/2015 10:27:55 PM "E:\Virus\Stegoloader deployment module executable\2bc4f6334e32264055c4a6594589ff8c6ed8cbb2ecf638d4b9e5d7dc1595e08e" "W32/Worm-FVY!1A035C679D56" "1"

6/19/2015 10:27:55 PM "E:\Virus\Stegoloader deployment module executable\cff2795820075f17b631667f15a37e97418b4ff5358986e2657232301c147935" "W32/Worm-FVW!71AFCFFE1BDC" "1"

6/19/2015 10:27:55 PM "E:\Virus\Stegoloader deployment module executable\da816a6a8cfe90d517a599bc261a04789a86f4ec0cb74f315020803d9a1bd8d5" "W32/Worm-FVX!DAE1884CAE15" "1"

6/19/2015 10:27:55 PM "E:\Virus\Stegoloader deployment module executable\b2727cd1374435e1f245462af1a0324d409987a84ec7825c80553a72247b17da" "W32/Worm-FVX!EA6249149F34" "1"

6/19/2015 10:27:55 PM "E:\Virus\Stegoloader deployment module executable\d642926bcdebbf70d1a39e19b9fb624064c7d80476c13aa225ba9cf831ea39fb" "W32/Worm-FVX!8AFD74209101" "1"

6/19/2015 10:27:55 PM "E:\Virus\Stegoloader deployment module executable\95b14d9b98d61a4babeb2a53ed159a5bc9c3a4a2148d16cc1cc9487795bca259" "BackDoor-FBLD!0C3BD774D8FB" "2"[/mw_shl_code]

显示全部楼层 · 发表于 2015-6-19 22:46:40

显示全部楼层 · 发表于 2015-6-19 22:48:06

趋势科技miss

显示全部楼层 · 发表于 2015-6-19 23:05:04

For Stegoloader deployment module executable.zip
ESS-CH killed all.
[mw_shl_code=xml,true]da816a6a8cfe90d517a599bc261a04789a86f4ec0cb74f315020803d9a1bd8d5 - Win32/Kryptik.CZGA 特洛伊木马的变种
e3c5fb0b3ce641b7d91e63521645018ccf1bd73468f1919dab0434d06ff53deb - Win32/Kryptik.CNQR 特洛伊木马的变种
0a58b98205c8542ae0516b4fe3ff8a4a6d6e9c199ec2d4e0de0aa8f9e1290328 > NSIS > 9604.exe - Win32/Kryptik.CNQR 特洛伊木马的变种
0a58b98205c8542ae0516b4fe3ff8a4a6d6e9c199ec2d4e0de0aa8f9e1290328 > NSIS > 1237.exe - Win32/Kryptik.CNQR 特洛伊木马的变种
1f8b5985c0e915ef6826693f21d05dab0e2d4645713c5eec66007f9a1d9e256b > 7ZSD > 1371.exe - Win32/Kryptik.CXAD 特洛伊木马的变种
1f8b5985c0e915ef6826693f21d05dab0e2d4645713c5eec66007f9a1d9e256b > 7ZSD > 4519.exe - Win32/Kryptik.CXAF 特洛伊木马的变种
2bc4f6334e32264055c4a6594589ff8c6ed8cbb2ecf638d4b9e5d7dc1595e08e - Win32/Kryptik.CZHI 特洛伊木马的变种
34aa0f16d978a691f8c323b83cb14d8576177f427ff9c07953a7a4a648b9a8e6 - Win32/Kryptik.CYMJ 特洛伊木马的变种
95b14d9b98d61a4babeb2a53ed159a5bc9c3a4a2148d16cc1cc9487795bca259 - Win32/Kryptik.BLXN 特洛伊木马的变种
3167f5094756daff4d5dc6065876bdb8601ad1c1dda71f145ebf084125a2a37f - Win32/Kryptik.CYRK 特洛伊木马的变种
b2727cd1374435e1f245462af1a0324d409987a84ec7825c80553a72247b17da - Win32/Kryptik.CZCH 特洛伊木马的变种
cff2795820075f17b631667f15a37e97418b4ff5358986e2657232301c147935 - Win32/Kryptik.CXVE 特洛伊木马的变种
d642926bcdebbf70d1a39e19b9fb624064c7d80476c13aa225ba9cf831ea39fb - Win32/Kryptik.CZGA 特洛伊木马的变种[/mw_shl_code]
For Additional modules.zip
ESS-CH missed all.

显示全部楼层 · 发表于 2015-6-19 23:07:06

Flying_Bird 发表于 2015-6-19 23:05
For Stegoloader deployment module executable.zip
ESS-CH killed all.
[mw_shl_code=xml,true]da816a6a ...

土豪的ESS正版，我只有EAV码，还是墨家给我的

显示全部楼层 · 发表于 2015-6-19 23:11:23

天蓝色的忧伤发表于 2015-6-19 23:07
土豪的ESS正版，我只有EAV码，还是墨家给我的

实际上不是正版的

显示全部楼层 · 发表于 2015-6-19 23:13:00

Huorong killed 3x. Other files have been sent to Huorong.
[mw_shl_code=xml,true]34aa0f16d978a691f8c323b83cb14d8576177f427ff9c07953a7a4a648b9a8e6 DEEP:VirTool/Obfuscator.gen!B
b2727cd1374435e1f245462af1a0324d409987a84ec7825c80553a72247b17da DEEP:VirTool/Obfuscator.gen!B
da816a6a8cfe90d517a599bc261a04789a86f4ec0cb74f315020803d9a1bd8d5 DEEP:VirTool/Obfuscator.gen!B[/mw_shl_code]

显示全部楼层 · 发表于 2015-6-19 23:13:15

Flying_Bird 发表于 2015-6-19 23:11
实际上不是正版的

难不成是麦大XX版

[可疑文件] Stegoloader: A Stealthy Information Stealer

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块