传奇私-Fu rootkit2x及释放程序

wowocock

00006666 发表于 2022-7-24 20:18
这种的如果处理不了，一般就是R3的释放程序没拉黑，等360那边拉黑就可以了

@wowocock

看了下，那个白的EXE，原来量很少，从7月11，12后，突然大量增加，估计就是被木马来利用了，已经让后台把那EXE都去白了。现在都能正常处理了，

wowocock

看了下，那个白的EXE，原来量很少，从7月11，12后，突然大量增加，估计就是被木马来利用了，已经让后台把那EXE都去白了。现在都能正常处理了，

谁谁谁

腾管16，4x

hiduwHUE

360扫描kill4
C:\360安全浏览器下载\rootkit\984610a8.sys        Win64/Rootkit.Generic.H8gAtUkA        已删除
C:\360安全浏览器下载\rootkit\9f097877.sys        Win64/Heur.Generic.H8gAZrMA        已删除
C:\360安全浏览器下载\rootkit\text\pdfctl32.dll        感染型病毒(Win32/Trojan.Generic.HgkASv0A)        已删除
C:\360安全浏览器下载\rootkit\text\text\pdfctl32.dll        感染型病毒(Win32/Trojan.Generic.HgkASv0A)        已删除

wwwab

rogersg 发表于 2022-7-24 18:55
ESET Smart Security Premium
984610a8.sys - a variant of Win64/Agent.ARD trojan
9f097877.sys - a va ...

Dear Wwwab,

Thank you for your submission.
The detection for this threat will be included in the next update of detection engine, expected version: 25650.


Regards,

ESET Malware Response Team

@ICzcz eset终于回我了

Jirehlov1234

笑死，老外搬运样本以为帖子标题的Fu是家族名

wwwab

Jirehlov1234 发表于 2022-7-26 18:13
笑死，老外搬运样本以为帖子标题的Fu是家族名

It is a kind of traditional and ancient multi-player game. It contact other players by private server.

ANY.LNK

微软已将全部已知的恶意样本入库，为此还添加了一个新的报毒名
984610a8.sys 9f097877.sys>Trojan:Win64/RootkitDrv!MSR
text\pdfctl32.dll text\text\pdfctl32.dll>TrojanProxy:Win32/Tnega!MSR

wwwab

anthonyqian 发表于 2022-7-24 19:45
我这里倒是有时会遇到样本被ELG拦截，但没自动上传的情况

看看小红伞：

Hello,

The analysis you requested is now complete:

Submission ID: #600945 File 归档.zip/984610a8.sys  SHA256 703398b4035af4058d3e2222b6cf08ad4488907af62607b8357311b47a07adbd  Type PE64  Size 1.432.112 bytes Category Malware Detection name TR/Agent.afdh VDF version 8.19.21.38 File 归档.zip/text/pdfctl32.dll  SHA256 52f91321863f002fb80db75fae1a9eae4454c0c6345288c62ce9d39b6d0e129e  Type PE32  Size 4.379.648 bytes Category Malware Detection name TR/Crypt.ZPACK.Gen VDF version 8.19.21.6 File 归档.zip/text/config.ini  SHA256 0d1c55a8a46e0e401204c877f80fabe3d9dd24f8f81a0d8d13f32274f11f0348  Type ASCII  Size 71 bytes Category Clean File 归档.zip/text/ini.ini  SHA256 d01c4e9bf10ed63e0de02bdaa54ae5a279486e9125f5febcc5d8bb3fab332568  Type ASCII  Size 5 bytes Category Clean File 归档.zip/text/New_B.db  SHA256 d10a70487bd1bf1d355c4484a3b548c1b01cdf4c1cc1c85b86eab3aec7ad3e10  Type unknown  Size 1.432.112 bytes Category Malware Detection name TR/NtRootKit.AQ VDF version 8.19.21.12 File 归档.zip/text/txt2pdf.exe  SHA256 1a1aa52989ed168cc75e41f6d8153030a15ef645a185eae6decc2a3a515eae11  Type PE32  Size 536.576 bytes Category Clean File 归档.zip/text/pdfctl64.dll  SHA256 b48ed74ee8bcaf9fd56c518ca5b2c7915f7cec7d6f93591cb5e793b6fc0fe78e  Type PE32  Size 281.088 bytes Category Clean File 归档.zip/text/New.db  SHA256 1b6ba2971dbf580ef99bc1f3f5245157a46219a87e970148e050f0a910fc63d9  Type unknown  Size 1.450.000 bytes Category Malware Detection name TR/Agent.aewl VDF version 8.19.21.12 File 归档.zip/text/text/pdfctl32.dll  SHA256 c0f73aa867834c2cf58e26c9ed063f036c4c46114785b048fa56b17d07ebba76  Type PE32  Size 1.939.968 bytes Category Riskware Detection name SPR/Agent.SZ VDF version 8.19.21.8 File 归档.zip/text/text/config.ini  SHA256 0d1c55a8a46e0e401204c877f80fabe3d9dd24f8f81a0d8d13f32274f11f0348  Type ASCII  Size 71 bytes Category Clean File 归档.zip/text/text/txt2pdf.exe  SHA256 1a1aa52989ed168cc75e41f6d8153030a15ef645a185eae6decc2a3a515eae11  Type PE32  Size 536.576 bytes Category Clean File 归档.zip/text/text/pdfctl64.dll  SHA256 b48ed74ee8bcaf9fd56c518ca5b2c7915f7cec7d6f93591cb5e793b6fc0fe78e  Type PE32  Size 281.088 bytes Category Clean File 归档.zip/9f097877.sys  SHA256 c9697041b8a63bef4239cf3174b63cae1ed5ecf199f49920c6d44fcc6ab30aa8  Type PE64  Size 1.450.000 bytes Category Malware Detection name TR/Agent.aeth VDF version 8.19.21.38

中间那个NtRootkit怎么感觉是抄的大蜘蛛，而且不止一家在抄

anthonyqian

wwwab 发表于 2022-7-27 20:49
看看小红伞：

[/td][/tr]

红伞的分析师一言难尽，之前有个fake TG的安装包，上报了后抄了个ESET的adware 的报法。。。