毒鼠 白加黑

hsks

可以看出来对面真的很讨厌360，直链问候一遍，shellcode也问候一遍（

快进到弹窗问候（

https://wwtw.lanzouq.com/irQrP1f5jygb
C2：154.91.64.196（y.zip）
https://www.virustotal.com/gui/f ... d44a3361a?nocache=1

发现毒鼠免杀性增强了，白加黑triage标1分（之前都是标可疑），黑dll也bypass了所有杀软（

Update：直链链接挂了，作者可能更换了新链接，因为原先的123网盘downloader无法访问所有直链，所以报错退出

不过作者还保留了个阿里云，停留在11月10日没更新（

@UNknownOoo

UNknownOoo

看出来了...不过C2似乎寄了？

金山的反射加载特征回来了（）

火绒
扫描：特征捉mdb
双击：MISS

X-Sec
扫描：MISS ALL

金山
双击：捉

hsks

UNknownOoo 发表于 2023-11-17 23:04
看出来了...不过C2似乎寄了？

火绒

这...我马上看看有什么替补shellcode

不过我这边突然访问不了直链链接了（

zfc234

webroot监控miss，双击防火墙询问不信任的程序试图联网，已阻止

hsks

好了，似乎作者取缔了原来的直链链接，downloader也无法访问并成功下载payload了（

我竟然在直链挂的前几分钟获取到了样本（

呼啸山庄

2023/11/17

Kaspersky Plus 21.15.8.493 Scan miss
Kaspersky Opentip miss (submitted to reanalyze)

ESET Smart Security Premium 17.0.15.0 (Version of detection engine: 28254P (20231117)) (LiveGuard Enabled) Scan miss

Log
Scan Log
Version of detection engine: 28254P (20231117)
Date: 2023/11/17  Time: 23:32:14
Scanned disks, folders and files: C:\Users\P02-1\Downloads\package\XXZShellBase.dll;C:\Users\P02-1\Downloads\package\360sb.mdb;C:\Users\P02-1\Downloads\package\AWDZVCE.exe
User: ASUS-TUF-GAMING\P02-1
C:\Users\P02-1\Downloads\package\360sb.mdb - is OK
C:\Users\P02-1\Downloads\package\AWDZVCE.exe - is OK
C:\Users\P02-1\Downloads\package\XXZShellBase.dll - is OK
Number of scanned objects: 3
Number of detections: 0
Time of completion: 23:32:14  Total scanning time: 0 sec (00:00:00)

ESET LiveGuard No Response

Time;Component;Event;User
2023/11/17 23:15:33;ESET Kernel;File 'XXZShellBase.dll' was sent to ESET Virus Lab for analysis.;SYSTEM
2023/11/17 23:15:40;ESET Kernel;File 'AWDZVCE.exe' was sent to ESET Virus Lab for analysis.;SYSTEM
2023/11/17 23:23:40;ESET Kernel;File '360sb.mdb' was sent to ESET Virus Lab for analysis.;SYSTEM

ESET Smart Security Premium 17.0.15.0 (Version of detection engine: 28254P (20231117)) (LiveGuard Enabled) AMS kill (Sandboxie v1.11.4)

Time;Scanner;Object type;Object;Detection;Action;User;Information;Hash;First seen here
2023/11/17 23:28:43;Advanced memory scanner;file;Operating memory » AWDZVCE.exe(31992);a variant of Win32/Farfli.DCO trojan;contained infected files;Sandboxie\DefaultBox;;20723A5B553B91CED0B98B9E749897AABABA7CAC;

Time: 2023/11/17 23:28:43
Scanner: Advanced memory scanner
Object type: file
Object: Operating memory » AWDZVCE.exe(31992)
Detection: a variant of Win32/Farfli.DCO trojan
Action: contained infected files
User: Sandboxie\DefaultBox
Information
Hash: 20723A5B553B91CED0B98B9E749897AABABA7CAC
First seen here

安恒云沙箱 miss https://sandbox.dbappsecurity.co ... cf5ad3/analyse/file
微步云沙箱 miss (有DLL反射，C2) https://s.threatbook.com/report/ ... a81f9dbfef0a074924e

反虚拟机，但可能不反沙箱？（还是沙箱逃逸？）
ESET submitted to analysis （应该提交过了）

2023/11/18 9:16

上报卡巴斯基

2023/11/18 9:55

Kaspersky Plus 21.15.8.493 KSN UDS:Trojan.Win32Dllhijack.a （好尴尬啊）

117054487

BEST MISS

嘿嘿不能说

Avast：0



放行之后没有任何拦截。

GDHJDSYDH

KTS沙箱内双击miss

dght432

360扫描miss