#银狐 downloader

显示全部楼层 · 发表于 2023-6-19 19:13:35

f95c5db3c31025b8e713199ba0a653a335f7da6a1b898e9023afaf206da0bd9a

显示全部楼层 · 发表于 2023-6-19 19:17:45

Gen:Suspicious.Cloud.2.@zW@a4fh6Cn

显示全部楼层 · 发表于 2023-6-19 19:20:56

bdf kill

显示全部楼层 · 发表于 2023-6-19 19:53:56

Sophos intelix

静态机器学习可疑；动态分析missed

显示全部楼层 · 发表于 2023-6-19 19:54:01

eset miss elg安全未上报未双击信誉良好

显示全部楼层 · 发表于 2023-6-19 20:00:19

360扫描miss

显示全部楼层 · 发表于 2023-6-19 20:11:24

火绒扫描miss

显示全部楼层 · 发表于 2023-6-19 20:51:34

WD:Trojan:Win32/Wacatac.H!ml

显示全部楼层 · 发表于 2023-6-19 20:55:59

SentinelOne
Shellcode detected

Persistence
Application registered itself to become persistent via scheduled task
MITRE : Persistence [T1053.005]
MITRE : Execution [T1053.005]
MITRE : Privilege Escalation [T1053.005]

Injection
Library was injected to a remote process
MITRE : Defense Evasion [T1055]
MITRE : Privilege Escalation [T1055]

Evasion
Suspicious registry key was created
MITRE : Defense Evasion [T1112][T1027][T1564.005][T1480.001]

Exploitation
Detected suspicious shellcode API call
MITRE : Execution [T1106][T1059]
Detected a shellcode that loads a DLL with socket APIs after process creation
MITRE : Defense Evasion [T1055.001]
MITRE : Privilege Escalation [T1055.001]

显示全部楼层 · 发表于 2023-6-19 20:58:50

本帖最后由 ziwang 于 2023-6-19 14:01 编辑

卡巴斯基miss
金山毒霸miss
微步：样本报告-微步在线云沙箱 (threatbook.com)

[病毒样本] #银狐 downloader

本帖子中包含更多资源