#PACKAGE 0813

√×√×√√×

囧，最开始扫描的时候国际版只扫出了22个，无OEM引擎，等10分钟后再扫已经变成26了，云拉黑的好快 囧囧囧 其中QVM干掉了18个




9号样本云拉黑，改md5后QVM再度检出
11号样本云拉黑，改md5后QVM再度检出
12号样本非云拉黑，但也不是QVM报的，改md5依然会被检出应该是入特征了
13号样本云拉黑，改md5后QVM再度检出
16号样本云拉黑，改md5后QVM再度检出
17号样本云拉黑，改md5后QVM再度检出
20号样本云拉黑，改md5后QVM再度检出


最后扫描无法检出的只有7和23号样本，开始双击——
23号样本运行后，会运行自带的火狐？？？但我系统里没装火狐，直接弹错后退出，期间主防没有反应，运行后系统也未见异常，但在appdata/Roaming/llk路径下会残留样本释放的kmj衍生文件，不会被扫描检出



7号样本运行后半天没反应……还以是坏的，直到运行其他程序后才有所动作，由此怀疑该样本存在反杀软虚拟环境检测，需要有启动其他程序的行为才会有动作，主防疯狂弹窗拦截后系统未见异常

Tmh

275751198 发表于 2018-8-13 19:11
360杀毒扫描日志

病毒库版本：

确实反应很快
本来扫出21的，就是在19：15时候
然后过多3分钟就多出3个了
现在我19：22三扫的时候，最后是25了

反过来看到上报的文件中
7.23.25没有发现危险

发现卫士和杀毒的报法都不一样，你这杀毒的qvm报了好多
莫非卫士和杀毒的qvm不一样

YU2711

SEP   18:57扫描部份25/28
剩下11 13 23
双击部份1/3
11Miss(内存自退)
13SONAR.SuspLaunch!g12
23Miss(内存)

总共:26/28

Tmh

云端的qvm和本地端的差好远啊
不过要是云端的那些qvm下放的话，估计容易被人找出免杀
技术不对称，人家难以做到免杀云qvm，还减少了人家工作量
要是下放到本地被做出一大堆免杀岂不是愁白头人家360的工作人员

Jerry.Lin

WD
CloudBlockLevel =6;
BlockAtFirstSeen= true;

扫描+双击

26/28


1.exe - Trojan:Win32/Fuerboos.C!cl
2.exe - Trojan:Win32/Azden.A!cl
3.exe - Trojan:Win32/Azden.A!cl
4.exe - Trojan:Win32/Fuerboos.C!cl
5.exe - Trojan:Win32/Azden.A!cl
6.exe - Trojan:Win32/Azden.A!cl
7.exe - Trojan:Win32/Fuerboos.C!cl
8.exe - Trojan:Win32/Azden.A!cl
9.exe - Trojan:Win32/Fuerboos.C!cl
10.exe - Trojan:Win32/Fuerboos.A!cl
11.exe - Trojan:Win32/Fuerboos.A!cl
12.exe - Backdoor:Win32/Fynloski.A
13.exe - MISS
14.exe - TrojanSpy:MSIL/Keylog.B
15.exe - Trojan:Win32/Fuerboos.C!cl
16.exe - Trojan:Win32/Azden.A!cl
17.exe - Trojan:Win32/Fuerboos.C!cl
18.exe - Trojan:Win32/Azden.A!cl
19.exe - Trojan:Win32/Fuerboos.C!cl
20.exe - Trojan:Win32/Fuerboos.C!cl
21.exe - Trojan:Win32/Azden.A!cl
22.exe - Trojan:Win32/Azden.A!cl
23.exe - MISS
24.exe - Trojan:Win32/Fuerboos.E!cl
25.exe - Trojan:Win32/Fuerboos.C!cl
26.exe - Trojan:Win32/Azden.A!cl
27.exe - Trojan:Win32/Fuerboos.A!cl
28.exe - Trojan:Win32/Fuerboos.C!cl

Picca

19:02 卡巴扫描 17 + 双击
4  PDM:Trojan.Win32.Generic
5  PDM:Trojan.Win32.Badur.a
6  PDM:Trojan.Win32.Generic
7  运行退出
8  PDM:Trojan.Win32.Generic
10 部分报错，弹出对话框，手动结束
15 PDM:Trojan.Win32.Generic
19 PDM:Trojan.Win32.Generic
23 无法安装卡巴ssl证书，firefox浏览https不再受浏览监控保护，并不确定样本是否生效，可以看成miss
25 PDM:Trojan.Win32.Generic
27 PDM:Trojan.Win32.Generic


*测试单个样本未重启，未使用高级清除

stupid1man

紅傘 19:38

實時防護：5
右鍵掃描：22
Total：27/28 (96.4%)

剩餘檔案：0813(23).exe 補充二掃（21:15）：殺 0813(23).exe

——————掃描部份——————

Start of the scan: 2018-08-13 19:38:40
08/13/2018,19-38-42        [INFO]        FP reports status 'NO False Positive' for file 'c:\users\shane siu\desktop\package 0813\0813(1).exe'
08/13/2018,19-38-42        [INFO]        Successful Cloud SDK initialization and license check.
08/13/2018,19-38-42        [INFO]        The file 'c:\users\shane siu\desktop\package 0813\0813(1).exe' was scanned with the Protection Cloud. SHA256 = 18771C7B6FDFACA92206668DF537626732C8C584A1C6E2EC47B168D59FE53750
08/13/2018,19-38-42        [INFO]        c:\users\shane siu\desktop\package 0813\0813(1).exe
08/13/2018,19-38-42        [INFO]        [DETECTION] file contains 'DR/Delphi.18771c'
08/13/2018,19-38-42        [INFO]        FP reports status 'NO False Positive' for file 'c:\users\shane siu\desktop\package 0813\0813(10).exe'
08/13/2018,19-38-42        [INFO]        c:\users\shane siu\desktop\package 0813\0813(10).exe
08/13/2018,19-38-42        [INFO]        [DETECTION] file contains 'TR/Dropper.Gen'
08/13/2018,19-38-43        [INFO]        FP reports status 'NO False Positive' for file 'c:\users\shane siu\desktop\package 0813\0813(11).exe'
08/13/2018,19-38-43        [INFO]        c:\users\shane siu\desktop\package 0813\0813(11).exe
08/13/2018,19-38-43        [INFO]        [DETECTION] file contains 'TR/Dropper.MSIL.Gen'
08/13/2018,19-38-43        [INFO]        FP reports status 'NO False Positive' for file 'c:\users\shane siu\desktop\package 0813\0813(13).exe'
08/13/2018,19-38-43        [INFO]        c:\users\shane siu\desktop\package 0813\0813(13).exe
08/13/2018,19-38-43        [INFO]        [DETECTION] file contains 'HEUR/AGEN.1008710'
08/13/2018,19-38-43        [INFO]        FP reports status 'NO False Positive' for file 'c:\users\shane siu\desktop\package 0813\0813(14).exe'
08/13/2018,19-38-43        [INFO]        c:\users\shane siu\desktop\package 0813\0813(14).exe
08/13/2018,19-38-43        [INFO]        [DETECTION] file contains 'TR/Dropper.Gen'
08/13/2018,19-38-44        [INFO]        FP reports status 'NO False Positive' for file 'c:\users\shane siu\desktop\package 0813\0813(15).exe'
08/13/2018,19-38-44        [INFO]        The file 'c:\users\shane siu\desktop\package 0813\0813(15).exe' was scanned with the Protection Cloud. SHA256 = 138671EEFD8C225F3B317C280768A22B2DF24E24BDE5D2DFE51083CE18F48B14
08/13/2018,19-38-44        [INFO]        c:\users\shane siu\desktop\package 0813\0813(15).exe
08/13/2018,19-38-44        [INFO]        [DETECTION] file contains 'TR/Dropper.VB.138671'
08/13/2018,19-38-44        [INFO]        FP reports status 'NO False Positive' for file 'c:\users\shane siu\desktop\package 0813\0813(16).exe'
08/13/2018,19-38-44        [INFO]        c:\users\shane siu\desktop\package 0813\0813(16).exe
08/13/2018,19-38-44        [INFO]        [DETECTION] file contains 'TR/Dropper.VB.Gen7'
08/13/2018,19-38-45        [INFO]        FP reports status 'NO False Positive' for file 'c:\users\shane siu\desktop\package 0813\0813(17).exe'
08/13/2018,19-38-45        [INFO]        The file 'c:\users\shane siu\desktop\package 0813\0813(17).exe' was scanned with the Protection Cloud. SHA256 = D02CA247A8842F7CEA592344AA4FF652025AC118DB513A1675F7C32EE38FA07C
08/13/2018,19-38-45        [INFO]        c:\users\shane siu\desktop\package 0813\0813(17).exe
08/13/2018,19-38-45        [INFO]        [DETECTION] file contains 'DR/Delphi.d02ca2'
08/13/2018,19-38-45        [INFO]        FP reports status 'NO False Positive' for file 'c:\users\shane siu\desktop\package 0813\0813(18).exe'
08/13/2018,19-38-45        [INFO]        The file 'c:\users\shane siu\desktop\package 0813\0813(18).exe' was scanned with the Protection Cloud. SHA256 = C288E92B2095AEF88859A8093D0C8DAE5162D334A08891248A0809D2B77F31CF
08/13/2018,19-38-45        [INFO]        c:\users\shane siu\desktop\package 0813\0813(18).exe
08/13/2018,19-38-45        [INFO]        [DETECTION] file contains 'TR/AD.Fareit.Y'
08/13/2018,19-38-46        [INFO]        FP reports status 'NO False Positive' for file 'c:\users\shane siu\desktop\package 0813\0813(2).exe'
08/13/2018,19-38-46        [INFO]        The file 'c:\users\shane siu\desktop\package 0813\0813(2).exe' was scanned with the Protection Cloud. SHA256 = 95E8767FA9136B39C8BF2F5D939E7F11D4BDF25D71704C270C0205AA90E74BD3
08/13/2018,19-38-46        [INFO]        c:\users\shane siu\desktop\package 0813\0813(2).exe
08/13/2018,19-38-46        [INFO]        [DETECTION] file contains 'TR/AD.Swotter.B'
08/13/2018,19-38-46        [INFO]        FP reports status 'NO False Positive' for file 'c:\users\shane siu\desktop\package 0813\0813(20).exe'
08/13/2018,19-38-46        [INFO]        The file 'c:\users\shane siu\desktop\package 0813\0813(20).exe' was scanned with the Protection Cloud. SHA256 = 5593B131F57B2FD6B8FC335042C66B1BFE5BE945505C141A4152E1041A906CDA
08/13/2018,19-38-46        [INFO]        c:\users\shane siu\desktop\package 0813\0813(20).exe
08/13/2018,19-38-46        [INFO]        [DETECTION] file contains 'DR/Delphi.5593b1'
08/13/2018,19-38-47        [INFO]        FP reports status 'NO False Positive' for file 'c:\users\shane siu\desktop\package 0813\0813(21).exe'
08/13/2018,19-38-47        [INFO]        c:\users\shane siu\desktop\package 0813\0813(21).exe
08/13/2018,19-38-47        [INFO]        [DETECTION] file contains 'TR/Dropper.Gen'
08/13/2018,19-38-47        [INFO]        FP reports status 'NO False Positive' for file 'c:\users\shane siu\desktop\package 0813\0813(22).exe'
08/13/2018,19-38-47        [INFO]        The file 'c:\users\shane siu\desktop\package 0813\0813(22).exe' was scanned with the Protection Cloud. SHA256 = FA2287326E319AB1AB113EE1935A1D1F9E4370AFD20F4A1DCCFFDF99CD87981D
08/13/2018,19-38-47        [INFO]        c:\users\shane siu\desktop\package 0813\0813(22).exe
08/13/2018,19-38-47        [INFO]        [DETECTION] file contains 'DR/Delphi.fa2287'
08/13/2018,19-38-48        [INFO]        FP reports status 'NO False Positive' for file 'c:\users\shane siu\desktop\package 0813\0813(26).exe'
08/13/2018,19-38-48        [INFO]        c:\users\shane siu\desktop\package 0813\0813(26).exe
08/13/2018,19-38-48        [INFO]        [DETECTION] file contains 'HEUR/AGEN.1001610'
08/13/2018,19-38-48        [INFO]        FP reports status 'NO False Positive' for file 'c:\users\shane siu\desktop\package 0813\0813(28).exe'
08/13/2018,19-38-48        [INFO]        The file 'c:\users\shane siu\desktop\package 0813\0813(28).exe' was scanned with the Protection Cloud. SHA256 = B193BC1F855CDCEDFD354674F99477DDC1225F8AAB84324BB7CF750BF0C89B40
08/13/2018,19-38-48        [INFO]        c:\users\shane siu\desktop\package 0813\0813(28).exe
08/13/2018,19-38-48        [INFO]        [DETECTION] file contains 'DR/Delphi.b193bc'
08/13/2018,19-38-49        [INFO]        FP reports status 'NO False Positive' for file 'c:\users\shane siu\desktop\package 0813\0813(3).exe'
08/13/2018,19-38-49        [INFO]        The file 'c:\users\shane siu\desktop\package 0813\0813(3).exe' was scanned with the Protection Cloud. SHA256 = 1039B4648AF6B09FD8AF6293AE3D201DE8F4E91C763C0144D703D9C7E4EA1A8F
08/13/2018,19-38-49        [INFO]        c:\users\shane siu\desktop\package 0813\0813(3).exe
08/13/2018,19-38-49        [INFO]        [DETECTION] file contains 'TR/AD.Nanocore.Y'
08/13/2018,19-38-49        [INFO]        FP reports status 'NO False Positive' for file 'c:\users\shane siu\desktop\package 0813\0813(4).exe'
08/13/2018,19-38-49        [INFO]        c:\users\shane siu\desktop\package 0813\0813(4).exe
08/13/2018,19-38-49        [INFO]        [DETECTION] file contains 'HEUR/AGEN.1015977'
08/13/2018,19-38-50        [INFO]        FP reports status 'NO False Positive' for file 'c:\users\shane siu\desktop\package 0813\0813(5).exe'
08/13/2018,19-38-50        [INFO]        The file 'c:\users\shane siu\desktop\package 0813\0813(5).exe' was scanned with the Protection Cloud. SHA256 = 8B1496FFAC6CFD4870547E635D1C5D4E824288B7C57C87E82879BB59FF6652FE
08/13/2018,19-38-50        [INFO]        c:\users\shane siu\desktop\package 0813\0813(5).exe
08/13/2018,19-38-50        [INFO]        [DETECTION] file contains 'HEUR/APC'
08/13/2018,19-38-50        [INFO]        FP reports status 'NO False Positive' for file 'c:\users\shane siu\desktop\package 0813\0813(6).exe'
08/13/2018,19-38-50        [INFO]        The file 'c:\users\shane siu\desktop\package 0813\0813(6).exe' was scanned with the Protection Cloud. SHA256 = B6ACFB3A6AE45F5FB08938E299D1798A34BE8E840B52D81B13BBA0EAAE972318
08/13/2018,19-38-50        [INFO]        c:\users\shane siu\desktop\package 0813\0813(6).exe
08/13/2018,19-38-50        [INFO]        [DETECTION] file contains 'TR/Dropper.VB.b6acfb'
08/13/2018,19-38-51        [INFO]        FP reports status 'NO False Positive' for file 'c:\users\shane siu\desktop\package 0813\0813(7).exe'
08/13/2018,19-38-51        [INFO]        The file 'c:\users\shane siu\desktop\package 0813\0813(7).exe' was scanned with the Protection Cloud. SHA256 = 7895BDB112BE4369FCB645B7D8050D2A4600B2CB88FC0BB89344C08054C4F285
08/13/2018,19-38-51        [INFO]        c:\users\shane siu\desktop\package 0813\0813(7).exe
08/13/2018,19-38-51        [INFO]        [DETECTION] file contains 'TR/AD.njLogger.Y'
08/13/2018,19-38-51        [INFO]        FP reports status 'NO False Positive' for file 'c:\users\shane siu\desktop\package 0813\0813(8).exe'
08/13/2018,19-38-51        [INFO]        The file 'c:\users\shane siu\desktop\package 0813\0813(8).exe' was scanned with the Protection Cloud. SHA256 = 86793D007FBBC83612AEB0E64DFD5E07E65EC7F75D691BDBA5207576C978CC2B
08/13/2018,19-38-51        [INFO]        c:\users\shane siu\desktop\package 0813\0813(8).exe
08/13/2018,19-38-51        [INFO]        [DETECTION] file contains 'TR/Dropper.VB.86793d'
08/13/2018,19-38-52        [INFO]        FP reports status 'NO False Positive' for file 'c:\users\shane siu\desktop\package 0813\0813(9).exe'
08/13/2018,19-38-52        [INFO]        The file 'c:\users\shane siu\desktop\package 0813\0813(9).exe' was scanned with the Protection Cloud. SHA256 = D9D74A2E0F0CA1C7F6035930AA247B24A4A1C30F6EA2FD115CEB1BB3CF8C45A3
08/13/2018,19-38-52        [INFO]        c:\users\shane siu\desktop\package 0813\0813(9).exe
08/13/2018,19-38-52        [INFO]        [DETECTION] file contains 'DR/Delphi.d9d74a'

Tmh

突发奇想，尝试了下断网的卫士
居然扫了19个，360有流式更新的吗
毕竟结合3楼这情况，断网后也能扫出来

√×√×√√×

Tmh 发表于 2018-8-13 19:38
突发奇想，尝试了下断网的卫士
居然扫了19个，360有流式更新的吗
毕竟结合3楼这情况，断网后也能扫出来

囧，云端QVM是有本地缓存的，除了12号样本确实是特征引擎报的之外，其他都是缓存 囧囧囧

Tmh

√×√×√√× 发表于 2018-8-13 19:39
囧，云端QVM是有本地缓存的，除了12号样本确实是特征引擎报的之外，其他都是缓存 囧囧囧

这就尴尬了，云端qvm居然有缓存