电视软件后台下载的文件

wajika

另外问下如何分析android样本的行为?
想知道这个样本到底有没有危害

kuroandsan

KFA

wajika

kuroandsan 发表于 2022-1-5 08:23
KFA

我也是用卡巴发现的

东南大学

大蜘蛛Kill

1. Engine 12.06.8.12260/7.00.52.08270 (2.2), 10753009 records, 2022/01/05 07:22
   
2. Last updated 2022/01/05 07:22
   
3. This is Windows XP Professional x86 (Build 2600), Service Pack 3
   
4. The user is INTEL\Administrator:INTEL\None [url=home.php?mod=space&uid=340]@[/url] INTEL
   
5. Using "..\st.drweb.com\static\beta_files\win\12.5\keys\drweb32.key" as Dr.Web Key file
   
6. This Dr.Web Key is for 1 computer (Beta Dr.Web)
   
7. WARNING! System has not been scanned for rootkits.
   
8. Scan files using 2 engines and "" mask
   
9. The mask was translated to "" filter
   
10. "c:\Downloads\20220105\1111.jar.bak/classes.dex" infected with Android.DownLoader.893.
    
11. "c:\Downloads\20220105\1111.jar.bak/classes.dex" - infected
    
12. "c:\Downloads\20220105\1111.jar.bak/assets/libnative-lib.so" - decompression error
    
13. "c:\Downloads\20220105\1111.jar.bak" - incurable, deleted, decompression error
    
14. WARNING! Restore points directories have not been scanned
    
15. Total 674.2 Kbytes in 1 file scanned (39 objects, 1 container)
    
16. Total 0 files are clean
    
17. Total 1 file are infected
    
18. Total 1 file is neutralized
    
19. Total 1 file are incurable
    
20. Total 1 file (2 objects) are raised error condition
    
21. Scan time is 00:00:25, 26KB/sec
    
22.                             Anti-Virus Dr.Web 12.6.8.12260 - Finished
    
23.           Engine 12.06.8.12260/7.00.52.08270 (2.2), 10753009 records, 2022/01/05 07:22
    
24. Scan time: 00:24 / 00:24             Done: 1 / 39             Speed:    28KB/S
    
25. 
    
26. Completed: 1 file, 674.2 KBytes

复制代码

Hacker-云

kuroandsan

wajika 发表于 2022-1-5 08:25
我也是用卡巴发现的

卡巴回复检测无误，好像刚开始报的是adware，后面改了

1. Hello,
   
2. 
   
3. This is not a false alarm. Detection is correct.
   
4. Thank you for your help.
   
5. 
   
6. Best regards, Maxim Starodubov, Malware analyst, Kaspersky Lab

复制代码

nhqlgd

ESSP直接拦截

wajika

kuroandsan 发表于 2022-1-5 10:08
卡巴回复检测无误，好像刚开始报的是adware，后面改了

上报给红伞 回复 Clean

wajika

classes.dex 这个玩意在做什么事？谁能看看

xiaobao233

火绒miss