2x (2023-06-16)

swizzer

https://t.wss.ink/f/bgp5p0h504j

BEST all.

1. 
   
2. 高级威胁防护阻止了一个恶意进程。进程路径: G:\Testing\230616\da2s1.exe. 威胁名称: ATC.SuspiciousBehavior.4108279A318C4CFB.
   
3. 
   
4. 高级威胁防护已阻止注入恶意代码的进程。进程路径: C:\Users\Public\WinZip\ypager.exe. 威胁名称: Generic.Keylogger.2.882DE70B.
   
5. 
   

复制代码

1 hour later:

1. 
   
2. G:\Testing\230616\Cinod\4a6d4.exe 是恶意软件 Gen:Suspicious.Cloud.2.6r0@aOIjqokj
   
3. G:\Testing\230616\Cinod\da2s1.exe 是恶意软件 Gen:Suspicious.Cloud.2.Lx0@aeo!PBgb
   

复制代码

Kaspersky missed all.(Scan)

运行后拦截其中一个衍生物的恶意外联，另一个反虚拟机。

1. Application name: ypager.exe
   
2. Application path: C:\Users\Public\WinZip
   
3. Component: Safe Browsing
   
4. Result description: Blocked
   
5. Type: Malicious link
   
6. Name: https://pastebin.com/raw/NAyC7E43
   
7. Precision: Exactly
   
8. Threat level: High
   
9. Object type: Web page
   
10. Object name: NAyC7E43
    
11. Object path: https://pastebin.com/raw
    
12. Reason: Cloud Protection

复制代码

往生全凭佛接引

360kill1另一个样本双击拦截后kill

post88

ESS 
4a6d4.exe;Win32/GenKryptik_AGen.ADK
da2s1.exe;Win32/Agent_AGen.BKZ

avast 1x

往生全凭佛接引

瑞星kill
Trojan.Kryptik!8.8 (CLOUD)

Trojan.Agent!8.B1E (CLOUD)

心醉咖啡

火绒

hansyu

McAfee kill 2x

往生全凭佛接引

奇安信kill

GreatMOLA

衍生物

莫求

腾管 kill 2x

yaokai815

金山毒霸miss all