#Backdoor(2022-8-2)

显示全部楼层 · 发表于 2022-8-2 10:15:12

From Telegram Channel : @zh_CNAQ
VT初扫3/70
https://www.virustotal.com/gui/f ... c5f6d29135bb39e50b2

显示全部楼层 · 发表于 2022-8-2 10:25:49

双击阻止
事件: 检测到恶意对象
应用程序: COM Surrogate
用户: \
用户类型: 发起者
组件: 系统监控
结果说明: 检测到
类型: 木马
名称: PDM:Exploit.Win32.Generic
威胁级别: 高
对象类型: 进程
对象路径: C:\Windows\SysWOW64
对象名称: dllhost.exe
原因: 行为分析
数据库发布日期: 今天，2022/8/2 5:42:00
MD5: AE1936CE9A4B92E69493470B1009AD5A

显示全部楼层 · 发表于 2022-8-2 11:21:09

Malwarebytes kill
Malware.Sandbox.1

火绒 miss

显示全部楼层 · 发表于 2022-8-2 11:28:12

我想问下 fake telegram都是金眼狗的东西吗？

显示全部楼层 · 发表于 2022-8-2 11:28:42

miss

显示全部楼层 · 发表于 2022-8-2 12:02:11

crowdstrike 双击殺

显示全部楼层 · 发表于 2022-8-2 12:14:37

pal家族发表于 2022-8-2 03:28
我想问下 fake telegram都是金眼狗的东西吗？

金眼狗是qi'anxin发明的叫法https://ti.qianxin.com/blog/articles/operation-dragon-breath-(apt-q-27)-dimensionality-reduction-blow-to-the-gambling-industry/

样本区看见的faketg大部分都是这个（类）组织相关的

显示全部楼层 · 发表于 2022-8-2 12:45:24

gdata

0 0 0 G DATA INTERNET SECURITY has prevented malicious software from running on your system.
0 0 0 The malicious program was identified by BEAST (Behavior Monitoring) as: Generic.C063FA77
0 0 0
128 0 0 The following processes were therefore terminated by G DATA for security reasons:
64 0 0 C:\ProgramData\ravmond.exe
64 0 0 C:\Windows\SysWOW64\svchost.exe (PID 14076)
64 0 0 C:\Windows\SysWOW64\dllhost.exe (PID 12160)
0 0 0
128 0 0 The following programs responsible were moved to Quarantine by G DATA:
64 0 0 C:\Windows\Temp\128030296.bak
64 0 0 C:\Windows\Temp\128030265.bak
64 0 0 C:\Windows\rscom.dll.dat
64 0 0 C:\Windows\rscom.dll
64 0 0 C:\Windows\Temp\Ä¬èÏ·Ö×é.key
0 0 0
0 0 0 Further information:
0 0 0 Ref: a99477a1-553e-4258-bbf7-417f806595f6

复制代码

显示全部楼层 · 发表于 2022-8-2 12:46:15

Jirehlov1234 发表于 2022-8-2 12:14
金眼狗是qi'anxin发明的叫法https://ti.qianxin.com/blog/articles/operation-dragon-breath-(apt-q-27)- ...

Hello,

New malicious software was found in the attached file. Its detection will be included in the next update.
HEUR:Backdoor.Win32.Gulpix.gen
Thank you for your help.

Best regards, Maxim Starodubov, Malware analyst, Kaspersky Lab
39A/3 Leningradskoe Shosse, Moscow, 125212, Russia Tel./Fax: + 7 (495) 797 8700 http://www.kaspersky.com https://securelist.com
https://opentip.kaspersky.com/ - get insights about suspicious files, hashes, URLs, IP addresses or domain names

__________________________________________

From: 724281640@qq.com
Received: 8/2/2022 3:30:36 AM (UTC)
Sent: 8/2/2022 3:30:19 AM (UTC)
To: newvirus@kaspersky.com
Subject: 回复：RE: 回复：RE: 回复：RE: 回复：RE: 回复：RE: Re:RE: Re:RE: Re:RE: Re:RE: Re:RE: Kaspersky false negative and false positive files [KL-1571859]

hello
here is a fake telegram installer, it is possible to be goldeneyedog APT releated backdoor malware.
after installation it will release a white exe to load malicious dll and script.

显示全部楼层 · 发表于 2022-8-2 12:48:09

eset miss

[病毒样本] #Backdoor(2022-8-2)

本帖子中包含更多资源

评分