#telegram-cn #Fake #Telegram #金眼狗（APT-Q-27）(2022-07-17)

显示全部楼层 · 发表于 2022-7-17 18:20:21

最近的样本都没啥新意，随便发发
https://jirehlov.lanzouv.com/iaGdD07xxked

https://www.virustotal.com/gui/f ... 84f520b54b1dadb3d9e

https://tdown[.sa.com/8228849c45e24bdcbe1be0130ad33d92:sg3/tsetupx64.zip
https://downs[.sa.com/8228849c45e24bdcbe1be0130ad33d92:sin3/Telegram.apk
https://downs[.sa.com/8228849c45e24bdcbe1be0130ad33d92:sg3/tsetupx64.zip
https://ttdown[.sa.com/8228849c45e24bdcbe1be0130ad33d92:down/tsteupX64.zip

上一集：https://bbs.kafan.cn/thread-2238758-1-1.html

显示全部楼层 · 发表于 2022-7-17 18:26:51

KIS Scan MISS

显示全部楼层 · 发表于 2022-7-17 18:32:43

eset扫描：Win32/Injector.ERVS.gen

显示全部楼层 · 发表于 2022-7-17 18:37:04

本帖最后由 rogersg 于 2022-7-17 18:57 编辑

Kaspersky
双击主防报 PDM:HackTool.Win32.VBInject.a，回滚删除所有释放文件

Event: Malicious object detected
Application: Telegram Setup
User: NT AUTHORITY\SYSTEM
User type: System user
Component: System Watcher
Result description: Detected
Name: PDM:HackTool.Win32.VBInject.a
Threat level: High
Object type: Process
Object path: c:\users\admin\desktop
Object name: tsteupx64.exe
Reason: Databases
Databases release date: 05/07/2022 01:11:00

复制代码

附几张Opentip的分析结果

显示全部楼层 · 发表于 2022-7-17 19:01:28

Rising
Spyware.Delf!8.12D

显示全部楼层 · 发表于 2022-7-17 19:07:38

Advanced Threat Defense

You must restart your device to finalize the cleaning process.
Bitdefender detected potentially malicious behavior and blocked all applications involved.
Detection ID: SuspiciousBehavior.DA52DA5646B90C62

显示全部楼层 · 发表于 2022-7-17 19:38:07

Norton 双击miss

显示全部楼层 · 发表于 2022-7-17 20:07:58

ESET沙盒双击无反应，安装完报Injector.ERVS.gen

显示全部楼层 · 发表于 2022-7-17 20:14:07

Ahn & FS 未报

显示全部楼层 · 发表于 2022-7-17 20:29:05

本帖最后由 1094947421 于 2022-7-17 20:30 编辑

火绒

[病毒样本] #telegram-cn #Fake #Telegram #金眼狗（APT-Q-27）(2022-07-17)

本帖子中包含更多资源

本帖子中包含更多资源

评分

本帖子中包含更多资源