Susp. Backdoor

Hibike

双击请把文件名改成ZD6.14USD_z05.exe

Jirehlov1234

成功跑起来的case：https://tria.ge/220616-qa6lgsfbbr/behavioral2

关键命令是

1. "C:\Users\Public\Documents\I0.exe" x -y -p38~Ca$4A C:/Users/Public/Documents/packet.db -oC:/Users/Public/Documents -aoa

复制代码

解密db，payload在里头，密码38~Ca$4A

Hibike

Jirehlov1234 发表于 2022-6-16 21:16
成功跑起来的case：https://tria.ge/220616-qa6lgsfbbr/behavioral2

关键命令是

试了下，跑起来的秘诀是把文件名改成 ( )_z( ).exe

括号内可以是任一字符

onedrive

诺顿：下载智能分析

Filename: UniConverter.exe
Threat name: WS.Reputation.1Full Path: C:\Users\realpc\Downloads\UniConverter\UniConverter.exe

____________________________

____________________________


On computers as of 
2022/6/16 at 18:02:45

Last Used 
2022/6/16 at 18:04:45

Startup Item 
No

Launched 
No

Threat type: Insight Network Threat. There are many indications that this file is untrustworthy and therefore not safe


____________________________


UniConverter.exe Threat name: WS.Reputation.1
Locate


Very Few Users
Fewer than 5 users in the Norton Community have used this file.

Very New
This file was released less than 1 week  ago.

Medium
This file risk is medium.


____________________________


https://bbs.kafan.cn/forum.php?m ... DM3Nzh8MjIzNzM1MQ==
Downloaded File  from bbs.kafan.cn
Source: External Media

UniConverter.exe

____________________________

File Actions

File: C:\Users\realpc\Downloads\UniConverter\ UniConverter.exe Removed
____________________________


File Thumbprint - SHA:
3b8505be49281014de604912f647b5fbb2ad15f43cd1336a33589635db7aff79
File Thumbprint - MD5:
ec67aa17541ffd8e38dbcb8f81b7d374

心醉咖啡

毒霸扫描miss

JuMin

咖啡 Miss

aboringman

1. 2022-06-16 18:08:28     恶意软件(HEUR/QVM202.0.FB2E.Malware.Gen)MD5:ec67aa17541ffd8e38dbcb8f81b7d374已删除此文件，如果您发现误删，可从隔离区恢复此文件。        d:\360极速浏览器x下载\uniconverter.exe

复制代码

UNknownOoo

智量：扫描+双击 逃逸

Hibike

UNknownOoo 发表于 2022-6-16 18:14
智量：扫描+双击 逃逸

这个样本直接双击是跑不开的。。

虽然运行方法我还没找到

UNknownOoo

Hibike 发表于 2022-6-16 18:17
这个样本直接双击是跑不开的。。

虽然运行方法我还没找到

az..

anthonyqian

ESET missed

LeeHS

什么？双击跑不开？那我不测了