faketg及其衍生物

显示全部楼层 · 发表于 2023-3-8 18:33:46

本帖最后由 117054487 于 2023-3-9 14:40 编辑

安装后衍生物会被自动隐藏，桌面快捷方式优先启动数签exe
安装包 vt 5/66
衍生物exe vt 11/70
衍生物dll vt 2/69
https://wwoa.lanzoub.com/inliT0pm6n9g
卡巴斯基回复

Hello,

New malicious software was found in the attached files. Its detection will be included in the next update.
Thank you for your help.

3A7A2F7B86296A8E4B80B655BA498278602068DB45517C30AFF845BBBCC9A94C - Trojan-Dropper.Win32.Agent.tewczq
4A1E40DAF6BBC09E73AD455CBA909BAF28D806B64FEEA3E9AB1DE69F5A14A423 - Trojan.Win32.Starter.aoar
CA8C316F47136900737DE669DAC112AB3DD6399F4FA806B91C8BF7E6CEB46AC8 - HEUR:Trojan.Win32.Loader.gen

Best regards, Ilya, Malware Analyst, Kaspersky
39A/3 Leningradskoe Shosse, Moscow, 125212, Russia Tel./Fax: + 7 (495) 797 8700 http://www.kaspersky.com https://securelist.com
https://opentip.kaspersky.com/ - get insights about suspicious files, hashes, URLs, IP addresses or domain names

Free Automated Malware Analysis Service - powered by Falcon Sandbox - Viewing online file analysis results for 'tcnx64-4.3.8.exe' (hybrid-analysis.com)

显示全部楼层 · 发表于 2023-3-8 18:47:04

显示全部楼层 · 发表于 2023-3-8 19:11:55

天守扫描MISS all

显示全部楼层 · 发表于 2023-3-8 20:12:03

显示全部楼层 · 发表于 2023-3-8 20:36:34

显示全部楼层 · 发表于 2023-3-8 20:38:46

761773275 发表于 2023-3-8 20:36

ENSISOFT好用不？检测率怎么样？

显示全部楼层 · 发表于 2023-3-8 21:19:18

显示全部楼层 · 发表于 2023-3-8 21:40:06

360未知

显示全部楼层 · 发表于 2023-3-8 22:20:08

显示全部楼层 · 发表于 2023-3-8 22:27:31

crowdstrike miss

[病毒样本] faketg及其衍生物