【更新，共6个】Fake Telegram(s)

LeeHS

第五个 crowdstrike miss

wwwab

还有一个027ea0e53058ef1bbf70db624977e4990899c8a74f65729441d2768c4b7930a9出来了：

Hello,

This file is already detected by our internal bases:
Backdoor.Win32.Lotok.hme
Detection will be included in the next update.
Thank you for your help.

anthonyqian

飞塔：

Based on our initial analysis, the sample contains unwanted content and warrant the following detection:

MD5: 69d858fcdb3397ff44d569a2ae2b1e39 - Riskware/ReBrandPkgTelegram

Jirehlov1234

anthonyqian 发表于 2022-6-9 05:40
飞塔：

Based on our initial analysis, the sample contains unwanted content and warrant the follow ...

这报的也太严谨了

内部个

迈克菲miss

mogu6666

Jirehlov1234 发表于 2022-6-9 11:04
很多系列是同时拥有多个域名来传播的，看一下有没有在我的合集https://github.com/Jirehlov/IoCs/blob/ma ...

把合集丢给BD和avast分析了
BD回复：

1. Hello,
   
2. 
   
3. I hope my email finds you well.
   
4. 
   
5. The URLs are malicious and have been blocked.
   
6. 
   
7. Have a great day ahead!
   
8. 
   
9. Best regards,
   
10. Adrian B
    
11. Bitdefender Premium Services Expert

复制代码

Avast回复：

1. Greetings,
   
2. 
   
3. Thank you for contacting Avast with your concerns.
   
4. 
   
5. Our virus specialists will go through the list and create detection for links that are not detected by Avast yet. Thank you for sharing this with us.
   
6. 
   
7. Best Regards
   
8. 
   
9. Ondřej
   
10. 
    
11. Avast Customer Care Team

复制代码

然鹅，随机从列表里挖了一个teleylc[.com这俩就都miss了，可能还没处理完

hushuai

mogu6666 发表于 2022-6-10 10:01
把合集丢给BD和avast分析了
BD回复：
Avast回复：

漂亮，BD除了telegramcn]org其他都拉黑了，我该说是够效率呢还是够无脑呢

mogu6666

hushuai 发表于 2022-6-11 08:18
漂亮，BD除了telegramcn]org其他都拉黑了，我该说是够效率呢还是够无脑呢

Avast现在列表里打得开的网页全部Threat secured，也是够快的

Jirehlov1234

mogu6666 发表于 2022-6-10 15:01
把合集丢给BD和avast分析了
BD回复：
Avast回复：

由Github的流量来源可知，小a用force.com管理上报之类的服务