Payload

显示全部楼层 · 发表于 2022-6-9 13:20:44

本帖最后由 swizzer 于 2022-6-9 13:24 编辑

https://funami.lanzoub.com/iTSEM064rquj

白加黑。黑dll看起来有不少玩法。
其中一个是这样

MicrosoftTimeTask.exe .\libexpat.dll XML_SetXmlDeclHandlerEx

复制代码

显示全部楼层 · 发表于 2022-6-9 13:25:10

Time;Scanner;Object type;Object;Detection;Action;User;Information;Hash;First seen here
9/6/2022 下午 1:24:19;Real-time file system protection;file;C:\Users\123\OneDrive\桌面\MicrosoftTimeUpdateTask\libexpat.dll;a variant of Win32/Packed.VMProtect.ACR trojan;cleaned by deleting;PIXEL\123;Event occurred during an attempt to access the file by the application: C:\Program Files\Microsoft OneDrive\OneDrive.exe (B4FE3B7A23DB38B39A1B094B2919909A5C242F55).;0571E0033A1499BE9147F7ED62B95C489EFD344C;9/6/2022 下午 1:24:13

显示全部楼层 · 发表于 2022-6-9 13:30:36

本帖最后由 huangzihang 于 2022-6-9 13:49 编辑

卡巴扫描0x

显示全部楼层 · 发表于 2022-6-9 13:39:21

显示全部楼层 · 发表于 2022-6-9 14:20:14

Hello,

New malicious software was found in the attached file. Its detection will be included in the next update.
libexpat.dll - Trojan.Win32.Pakes.axkn
Thank you for your help.

显示全部楼层 · 发表于 2022-6-9 14:30:18

过了很久……
Bitdefender detected potentially malicious behavior and blocked all applications involved.
Detection ID: SuspiciousBehavior.E6D1FDB246B43437

显示全部楼层 · 发表于 2022-6-9 17:48:24

6/8火绒扫描miss

显示全部楼层 · 发表于 2022-6-9 19:15:33

毒霸0

显示全部楼层 · 发表于 2022-6-9 20:56:36

咖啡扫描miss

显示全部楼层 · 发表于 2022-6-9 21:34:54

360杀毒扫描miss

[病毒样本] Payload

本帖子中包含更多资源