疑似dll服务型白加黑 x1

biue

wwwab

微软：The submitted files do not meet our criteria for malware or potentially unwanted applications. No detection will be added for these files.

libexpat.dll被标注的是Threat Related未添加检测，其他都是Not malware       

wwwab

我爱你啊啊啊 发表于 2022-9-10 21:38
过卡巴

Hello,

New malicious software was found in the attached file.
Trojan-Downloader.Win32.DLLhijack.c
Its detection will be included in the next update.
Thank you for your help.

心心相印

迈克菲1x

wwwab

Hello there,

Thank you for your patience.

I received an update from the SophosLabs team and have determined the following:

Item Comments:
=============

From the submitted files, below mentioned files are marked as not detect-worthy:

fdsvc.dll, 57d8e9a54b7ba6d3594ba4f13aa4db49b8a29321 => not detect-worthy
Microsoft.VC90.ATL.manifest, 91d9a44ee27f321b8eb844709555e5cda4d8d469 => not detect-worthy
Microsoft.VC90.CRT.manifest, 29f568508a65f5177c6044544248893a876a666f => not detect-worthy
msvcp90.dll, a230e64e0a5830544a25890f70ce9c9296245945 => not detect-worthy
msvcr90.dll, 29268ef0cd220ad3c5e9812befd3f5759b27a266 => not detect-worthy
srv.reg, dc26ee645bf82d989cc9b3c562a849b9c5792f66 => not detect-worthy

While on the below-mentioned file, it pretends to be libexpat.dll, an open source XML parser but it’s a component of Asbit RAT indeed. (GitHub - libexpat/libexpat: Expat library: Fast streaming XML parser written in C99; migrated from SourceForge to GitHub)

libexpat.dll, baf30ea77bec9223a3714f00e6cbadd4016c9061

Additional information here: Asbit: An Emerging Remote Desktop Trojan | Official Juniper Networks Blogs

Troj/Asbit-A has been created.

As per the SophosLabs team, the above-submitted files have now been tagged as not detect worthy except for the last file libexpat.dll, baf30ea77bec9223a3714f00e6cbadd4016c9061. SophosLabs created Troj/Asbit detection for this sample file.

The ticket will now be closed.

anthonyqian

wwwab 发表于 2022-9-13 06:42
Hello there,

Thank you for your patience.

回复的好认真… 真不戳

Hacker-云