js/downloader (2023-08-12)

显示全部楼层 · 发表于 2023-8-13 00:11:12

BDTS MISS

显示全部楼层 · 发表于 2023-8-13 00:20:34

anthonyqian 发表于 2023-8-12 22:56
Avira

Scan missed

带后缀？

显示全部楼层 · 发表于 2023-8-13 08:42:00

本帖最后由 anthonyqian 于 2023-8-13 09:40 编辑

IamAngry 发表于 2023-8-12 23:27
这个检测有意思了，难道是专门针对脚本的APC启发？

看上去是的如果apc支持脚本类了还是很值得期待的……

稍微修改了一下1.js，重新执行，研究了一下log:

[2023-08-13 08:46:21.816] [info] [BaseScan] [thread id: 8876] The file '\\?\C:\Users\Desktop\1.js' was unknown in the Protection Cloud. SHA256: '4d6b54a14476efc43b3c1a54f9eab507172827b32bbbf92353618*****' Flags: '{Upload needed}' Status: successful —— 未知脚本会主动上传APC进行分析
[2023-08-13 08:46:21.817] [info] [Core] [thread id: 8876] [ProtectionCloud] [apcsdk] file: 1 of 1 unique hashes left to check
[2023-08-13 08:46:22.037] [info] [Core] [thread id: 5952] [ProtectionCloud] Starting upload of file 'C:\Users\\Desktop\1.js'
[2023-08-13 08:46:22.971] [info] [Core] [thread id: 5952] [ProtectionCloud] Upload of file 'C:\Users\\Desktop\1.js' was successful
[2023-08-13 08:46:27.990] [info] [Core] [thread id: 8876] [ProtectionCloud] [apcsdk] file: 1 of 1 unique hashes left to check
[2023-08-13 08:46:28.205] [info] [BaseScan] [thread id: 8876] The file '\\?\C:\Users\\Desktop\1.js' has been uploaded to the Protection Cloud and analyzed. SHA256: '4d6b54a14476efc43b3c1a54f9eab507172827b****' Flags: '{Detected}{Upload done}' Status: successful —— APC花了约7秒时间分析脚本，结果是detected。
[2023-08-13 08:46:28.205] [info] [BaseScan] [thread id: 8876] The file '\\?\C:\Users\\Desktop\1.js' was scanned with the Protection Cloud. SHA256: '4d6b54a14476efc43b3c1a54f9eab507172827b32bbbf9235*****' Flags: '{Detected}{Upload done}' Status: successful
[2023-08-13 08:46:28.205] [info] [BaseScan] [thread id: 8876] Detection by Protection Cloud: '{HEUR/APC.YAV} File: '\\?\C:\Users\\Desktop\1.js' SHA256:'4d6b54a14476efc43b3c1a54f9eab50717*****' ————最终给出检测名<

随便双击了去年还没入库的JS脚本，又看到了一个没见过的APC检测HEUR/APC.Gendit。。。

显示全部楼层 · 发表于 2023-8-13 08:48:08

360扫描miss

显示全部楼层 · 发表于 2023-8-13 13:00:25

WD：Trojan:Win32/Casdet!rfn

离谱，虚拟机运行秒杀，实体机运行没反应。虚拟机win10 实体机win11

显示全部楼层 · 发表于 2023-8-13 14:32:48

McAfee 双击RP-fileless杀js本体。
Real Protect-JSL!6e5be75b6819

显示全部楼层 · 发表于 2023-8-13 14:42:09

没跑出来，可能对方又挂了。。。。。。

但本体被上传。

显示全部楼层 · 发表于 2023-8-14 13:20:09

跑不起来

[病毒样本] js/downloader (2023-08-12)

本帖子中包含更多资源