山东移动高校宽带SendData.dll

啊小白

Picca 发表于 2020-10-10 17:42
卡巴斯基网页拦截

那看来确实有问题

啊小白

anthonyqian 发表于 2020-10-10 17:55
MES miss

谢谢

啊小白

QWQxd 发表于 2020-10-10 20:48
https://habo.qq.com/file/showdetail?pk=ADcGYl1lB2MIOVs1U2Q%3D
腾讯哈勃  轻度风险

谢谢大佬

川建国代理人

https://sandbox.ti.qianxin.com/sandbox/page/detail?type=file&id=AXUSp7Sh4ZOYmadkjznf&env=&time=&sha1=cb01d9e66ec1b7ccd872d7f4e0230bce0927b3a6
两个境内IP进行远控，还有恶意网站推广

1. 116.211.100.181
   

复制代码

https://ti.qianxin.com/v2/search?type=ip&value=116.211.100.181

1. dssp.eyoodns.com

复制代码

https://ti.qianxin.com/v2/search?type=domain&value=dssp.eyoodns.com
https://www.virustotal.com/gui/url/77c72239400be956ddb121ea67bf579fcfd4dda5c1a7aa9222d410e5001a3497/detection
比较老，2013年就创建了这个文件，现在网站已经服务器响应过长了。。

蝙蝠BATGOD

啊小白 发表于 2020-10-10 20:51
谢谢大佬提供的信息

没事

蝙蝠BATGOD

啊小白 发表于 2020-10-10 21:00
为什么会出现不一致呢？

hello 有可能因为网络、环境、系统等因素

第二个号

QVM360

Wesly.Zhang 发表于 2020-10-10 16:42
Hello，

有人能够

经鉴定该文件为可疑文件！

主进程：rundll32.exe

1. 命令行："C:\Windows\System32\rundll32.exe" "C:\Users\admin\AppData\Local\Temp\SendData.dll", Ext_RunDLL

复制代码

行为：
>连接到CnC服务器

1. 连接的ip: 183.95.89.203; 119.96.200.176

复制代码

>读取浏览器缓存数据

1. 在注册表中的路径: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
   
2. 名称: MimeExclusionListForCache
   
3. 操作: 读取
   
4. 目标值类型: REG_SZ
   
5. 值: multipart/mixed multipart/x-mixed-replace multipart/x-byteranges
   
6. 时间: 78 ms

复制代码

移动的文件：0
修改的注册表：9

1. WRITE
   
2. +2141ms
   
3. Key:        HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
   
4. Name:        CachePrefix
   
5. Value:        (value not set)
   
6. WRITE
   
7. +2141ms
   
8. Key:        HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
   
9. Name:        CachePrefix
   
10. Value:        Cookie:
    
11. WRITE
    
12. +2156ms
    
13. Key:        HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
    
14. Name:        CachePrefix
    
15. Value:        Visited:
    
16. WRITE
    
17. +2235ms
    
18. Key:        HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
    
19. Name:        ProxyEnable
    
20. Value:        0
    
21. WRITE
    
22. +2235ms
    
23. Key:        HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
    
24. Name:        SavedLegacySettings
    
25. Value:        46 00 00 00 A5 00 00 00  01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 C0 E3 33 BB EA B1 D3 01  00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00  17 00 00 00 00 00 00 00 FE 80 00 00 00 00 00 00  7D 6C B0 50 D9 C5 73 F7 0B 00 00 00 00 00 00 00  6D 00 33 00 32 00 5C 00 4D 00 53 00 49 00 4D 00  47 00 33 00 32 00 2E 00 64 00 6C 00 01 00 00 00  04 AA 40 00 14 AA 40 00 04 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  02 00 00 00 C0 A8 01 64 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00  00 00 00 00 80 5D 3F 00 98 37 40 00 00 08 00 00  02 00 00 00 00 00 00 60 00 00 00 20 60 04 00 00  B8 A9 40 00 02 00 00 00 88 02 00 00 60 04 00 00  B8 A9 40 00 04 00 00 00 F8 01 00 00 B2 84 00 00  88 B6 40 00 B8 4B 40 00 43 00 3A 00 00 00 00 00  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    
26. WRITE
    
27. +2235ms
    
28. Key:        HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
    
29. Name:        UNCAsIntranet
    
30. Value:        0
    
31. WRITE
    
32. +2235ms
    
33. Key:        HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
    
34. Name:        AutoDetect
    
35. Value:        1
    
36. WRITE
    
37. +2235ms
    
38. Key:        HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
    
39. Name:        UNCAsIntranet
    
40. Value:        0
    
41. WRITE
    
42. +2235ms
    
43. Key:        HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
    
44. Name:        AutoDetect
    
45. Value:        1

复制代码

HTTP响应：1

1. URL: dssp.stnts.com

复制代码

连接的服务器：2

1. 183.95.89.203 (dssp.stnts.com)
   
2. 183.95.89.203 (dssp.stnts.com)

复制代码

啊小白

川建国代理人 发表于 2020-10-10 21:26
https://sandbox.ti.qianxin.com/sandbox/page/detail?type=file&id=AXUSp7Sh4ZOYmadkjznf&env=&time=&sha1 ...

感谢大佬。
那看来是早起推广这个客户端的时候，置入了几个流氓功能。但是随着版本更新，金盆洗手了？

wwwab

我感觉应该是供应链污染，加上这个客户端发现多年未更新导致的

应该类似于这件事儿https://www.sohu.com/a/202122398_404443