FakeAPP #Signed

hsks

前情提要：https://twitter.com/IM_23pds/status/1702587581593211263

还记得之前用aicoin钓鱼的那个样本吗？

没错，这个钓鱼网站还在XX（和谐）谷歌上挂着，并且今天我发现它更新了（2个月啊，2个月！）

很喜欢MalwareHunterTeam的一句话（
11月10日的样本，360显示11月11日被云端发现（虽然没拉黑）今天才上传至VT，只有瑞星靠拉黑签名报，ESET加壳报

https://www.virustotal.com/gui/f ... 39a0ec9f9?nocache=1
可以测测白加黑payload（IObit BrowserProtect.exe 白加黑 AAProtects.exe）
C2： 154.92.99.3:11570     aa2.jq993（.）com

好吧，似乎payload没替换，不过杀软报毒率跟之前差不多（

https://www.123pan.com/s/FJUmjv-5izN.html
https://share.weiyun.com/HxpBMUFu
https://pan.huang1111.cn/s/G4VMhW

@swizzer

dght432

360扫描miss

UNknownOoo

火绒
扫描：特征 1X

1. 病毒名称：TrojanDropper/Agent.qe
   
2. 病毒ID：93D62ED87EC948F2
   
3. 病毒路径：C:\Users\Administrator\AppData\Local\Temp\BNZ.655978fc124e95\aicoine.exe
   
4. 操作类型：修改
   
5. 操作结果：已处理，删除文件
   

复制代码

心醉咖啡

金山毒霸扫描miss

呼啸山庄

2023/11/19 11:36

Kaspersky Plus 21.15.8.493 Scan miss
Kaspersky Opentip Malware Trojan.Win32.Blamon.sb https://opentip.kaspersky.com/1A ... /results?tab=upload

ESET Smart Security Premium 17.0.15.0 (Version of detection engine: 28261P (20231118)) (LiveGuard Enabled) Scan kill?

Scan Log
Version of detection engine: 28261P (20231118)
Date: 2023/11/19  Time: 10:39:16
Scanned disks, folders and files: C:\Users\P02-1\Downloads\aicoine\aicoine.exe
User: ASUS-TUF-GAMING\P02-1
...
C:\Users\P02-1\Downloads\aicoine\aicoine.exe » ADVANCEDINSTALLER » setup1.cab » CAB » webres.dll - a variant of Win32/Packed.BlackMoon.A suspicious application - retained
...
Number of scanned objects: 4996
Number of detections: 1
Number of cleaned objects: 0
Time of completion: 10:39:33  Total scanning time: 17 sec (00:00:17)

嘿嘿不能说

安装杀1衍生物

真小读者

瑞星

PYAS_Security

Engine: PYAS ML Engine
Detect: Virus
Levels: 1.0/0.5906735751295337
File: C:\Users\Windows\Downloads\aicoine\aicoine.exe

ANY.LNK

微软双击报告Trojan:Script/Wacatac.H!ml

hhhq316

蜘蛛Miss
EMSI