#RedLineStealer

761773275

swizzer 发表于 2022-5-8 14:02
这个报错窗口是假报错

如果允许联网，不出意料接下来样本就会尝试读取浏览器储存的密码了

卧槽，我入沙了不会有事吧？

swizzer

761773275 发表于 2022-5-8 14:12
卧槽，我入沙了不会有事吧？

你允许联网了吗
允许了估计就g了

默认情况下沙盒是不防读取的，毛豆的我记得也不例外···

真小读者

咖啡清空

Tom179090

The file E:\infected\Stealer\1f9c359e6ca352e1.exe is infected with Gen:Variant.Razy.778634 and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean
The file E:\infected\Stealer\a8b816a8f30bd59d.exe has been detected as infected. The threat has been successfully blocked, your device is safe.
The file E:\infected\Stealer\64e0d7a7017b3f54.exe is infected with Gen:Variant.Razy.747952 and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.

lvzhiwei

除了垫底选手熊猫扫描全部miss，腾讯管家扫描1X，scureaplus解压apex引擎发现加手动扫描EMSISOFT发现1X，总2X

huangzihang

编辑...是Chrome的自动翻译..

决定式～定义

居然是IPS发威，不过针对有多种攻击特征的，IPS有时候拦了一种就不管主程序了。。

zwl2828

Microsoft Defender

Stealer\1f9c359e6ca352e1.exe
Trojan:Win32/Sabsik.FL.A!ml

开开心心卖手机

Avast kill all

1. * Avast 实时防护操作报告
   
2. * 该文件是自动生成的
   
3. *
   
4. * 开始于: 2022年5月8日 15:14:04
   
5. *
   
6. 
   
7. 2022/5/8 16:14:48        C:\Users\**\Desktop\64e0d7a7017b3f54.exe [L] Win32:Malware-gen (0)
   
8. 文件已成功移至隔离区...
   
9. 2022/5/8 16:14:50        C:\Users\**\Desktop\1f9c359e6ca352e1.exe [L] Win32:Evo-gen [Susp] (0)
   
10. 文件已成功移至隔离区...
    
11. 2022/5/8 16:14:53        C:\Users\**\Desktop\a8b816a8f30bd59d.exe [L] Sf:ShellCode-CG [Trj] (0)
    
12. 文件已成功移至隔离区...

复制代码

anxiety520

卡巴双击hips均不信任，然而卡巴出bug，hips和pdm都不工作了实体机感觉要出大事