#Farfli (2023-06-28)

swizzer

https://t.wss.pet/f/bkb9253sxr7

持之以恒的作者...

1. 高级威胁防护已阻止注入恶意代码的进程。进程路径: G:\Temp\InfectedBox\user\public\WinZip\ypager.exe. 威胁名称: AI:Plugx.45841.6F58371B1C.

复制代码

Avast 1.5h极速入库

Win32:RATX-gen

套层vmp后被CyberCapture暂时阻断，关闭CC后IDP拦截衍生物

yaokai815

金山毒霸miss

隔山打空气

S1 Behavior AI 杀
改了但没完全改

Persistence
Application registered itself to become persistent via an autorun
MITRE : Persistence [T1547.001]
MITRE : Privilege Escalation [T1547.001]
Detected persistency via scheduled task
MITRE : Persistence [T1053.005]
MITRE : Execution [T1053.005]
MITRE : Privilege Escalation [T1053.005]
Application registered itself to become persistent via scheduled task
MITRE : Persistence [T1053.005]
MITRE : Execution [T1053.005]
MITRE : Privilege Escalation [T1053.005]

Exploitation
Detected a shellcode that loads a DLL with socket APIs after process creation
MITRE : Defense Evasion [T1055.001][T1140]
MITRE : Privilege Escalation [T1055.001]

Evasion
Process started with a spoofed parent process
MITRE : Defense Evasion [T1134.004]
MITRE : Privilege Escalation [T1134.004]
A new root certificate was added
MITRE : Defense Evasion [T1553.004]

km_xyx

ESET Win32/GenKryptik_AGen.ADK 特洛伊木马 的变量

胡淇允

avast scan miss

Hibike

1. Name: VHO:Backdoor.Win32.Agent.gen
   
2. Precision: Heuristic Analysis
   
3. Threat level: High
   
4. Object type: File
   
5. Object name: hanabi.exe
   
6. Object path: C:\Users\Sawtooth\Desktop
   
7. MD5 of an object: 426A0B632685E95A7DC412F83CFF7CC8

复制代码

biue

喀反

WD解压：Trojan:Win32/Wacatac.H!ml

UNknownOoo

火绒
扫描&双击：寄

dght432

360扫描miss