#Farfli (2023-07-03)

swizzer

黑Dll有所改动，从而绕过了卡巴PDM.不过靠拦截访问pastebin，卡巴姑且还是防御成功。

1. Application path: C:\Users\Public\WinZip
   
2. Component: Safe Browsing
   
3. Result description: Blocked
   
4. Type: Malicious link
   
5. Name: https://pastebin.com/raw/6TLYbUVp
   
6. Precision: Exactly
   
7. Threat level: High
   
8. Object type: Web page
   
9. Object name: 6TLYbUVp
   
10. Object path: https://pastebin.com/raw
    
11. Reason: Cloud Protection

复制代码

火绒的特征也被过掉了





BEST blocked.

1. 高级威胁防护已阻止注入恶意代码的进程。进程路径: G:\Testing\230703\23167126\WinZip\ypager.exe. 威胁名称: AI:Ursnif.45841.A5F7E5B61C.

复制代码

LovelyTim

奇安信 miss

琳辰

ESET detected.

kumiko.exe - a variant of Win32/GenKryptik_AGen.ADK trojan

心醉咖啡

金山毒霸扫描miss

dght432

360扫描miss

dght432

hansyu

McAfee
ti!90357E53D292

post88

avastkill

biue

LeeHS

crowdstrike 解压杀