毒鼠 白加黑

hsks

客服不回我邮件了（

2h前更新
https://www.virustotal.com/gui/f ... 4ab992d4e?nocache=1
C2：202.95.8.245（h.zip）

呼啸山庄

2023/11/14 23:20

Firefox kill

卡巴斯基加强版 21.15.8.493 scan miss
ESET Smart Security Premium 17.0.10.0 (Version of detection engine: 28231P (20231113)) scan miss
ESET Smart Security Premium 17.0.10.0 LiveGuard NoResponse

Log
Scan Log
Version of detection engine: 28231P (20231113)
Date: 2023/11/14  Time: 23:18:57
Scanned disks, folders and files: C:\Users\P02-1\Downloads\package
User: ASUS-TUF-GAMING\P02-1
C:\Users\P02-1\Downloads\package\TCWCWCa.exe - is OK
C:\Users\P02-1\Downloads\package\TCWCWCa.exe:Zone.Identifier - is OK
C:\Users\P02-1\Downloads\package\qqhxsjBase.dll - is OK
C:\Users\P02-1\Downloads\package\qqhxsjBase.dll:Zone.Identifier - is OK
C:\Users\P02-1\Downloads\package\students.mdb - is OK
C:\Users\P02-1\Downloads\package\students.mdb:Zone.Identifier - is OK
Number of scanned objects: 6
Number of detections: 0
Time of completion: 23:18:57  Total scanning time: 0 sec (00:00:00)

ESET Smart Security Premium 17.0.10.0 (Version of detection engine: 28231P (20231113)) mem kill (Sandboxie-Plus v1.11.4)

Time;Scanner;Object type;Object;Detection;Action;User;Information;Hash;First seen here
2023/11/14 23:20:29;Advanced memory scanner;file;Operating memory » TCWCWCa.exe(11752);a variant of Win32/Farfli.DCO trojan;contained infected files;Sandboxie\DefaultBox;;16ADC1680503731F9D360E8A7C970DE200D7E852;

Time: 2023/11/14 23:20:29
Scanner: Advanced memory scanner
Object type: file
Object: Operating memory » TCWCWCa.exe(11752)
Detection: a variant of Win32/Farfli.DCO trojan
Action: contained infected files
User: Sandboxie\DefaultBox
Information:
Hash: 16ADC1680503731F9D360E8A7C970DE200D7E852
First seen here:

hsks

呼啸山庄 发表于 2023-11-14 23:17
2023/11/14 23:20Firefox kill

卡巴斯基加强版 21.15.8.493 scan miss

ESET的内存特征还是稳啊

心醉咖啡

金山毒霸扫描miss

秋日之殇

卡巴g了

UNknownOoo

火绒
扫描：MISS

1. 病毒库时间：2023-11-14 17:43
   
2. 开始时间：2023-11-15 00:19
   
3. 总计用时：00:00:01
   
4. 扫描对象：5
   
5. 扫描文件：3
   
6. 发现风险：0
   
7. 已处理风险：0
   

复制代码

X-Sec
扫描：MISS


金山内存防护被过了...

hsks

UNknownOoo 发表于 2023-11-15 00:26
火绒
扫描：MISS

每个zip里的shellcode都试一遍，总会有pass杀软的（

UNknownOoo

hsks 发表于 2023-11-15 00:27
每个zip里的shellcode都试一遍，总会有pass杀软的（

毒鼠家之前捉的蛮稳定的来着...（其他样本包我基本不测金山的

骨灰级小白

卡巴，扫描和双击都miss,ksn放入受信任组

117054487

bd还是把白文件删了

实时防护检测到威胁。该文件已被删除。C:\Users\123456\Desktop\package\TCWCWCa.exe 是恶意软件 Trojan.Agent.GHRA