可疑驱动 火绒报Rootkit/Agent.dy

取名字难

万能的Trojan.Generic报法

ANY.LNK

带有效WHQL的，我稍后看看能不能分析下

pal家族

Hello,

The attached file can not be analyzed standalone.
Could you please send us files which related to this driver (it can be found in the system services list properties)?

Best regards, Arina, Malware Analyst
39A/3 Leningradskoe Shosse, Moscow, 125212, Russia Tel./Fax: + 7 (495) 797 8700 http://www.kaspersky.com https://securelist.com
https://opentip.kaspersky.com/ - get insights about suspicious files, hashes, URLs, IP addresses or domain names

有没有提取到母体或其他相关文件呢？
然后这有可能其实是可执行文件吗

anthonyqian

飞塔老哥说安全。

We have received the file you have sent with md5:f2002b81af3e10ef51a702aa4fadea1f
and have verified based on our initial quick analysis that
it did not perform malware like behavior.

kaba666

pal家族 发表于 2024-3-10 04:16
Hello,

The attached file can not be analyzed standalone.

怪不得，我说怎么运行不起来

DisaPDB

pal家族 发表于 2024-3-10 04:16
Hello,

The attached file can not be analyzed standalone.

没有可能，能看到DriveEntry入口
而且这货做了极为逆天的控制流混淆

qzuser_pure

卡巴的人不想分析，偷懒

吃瓜群众第123位

drweb miss

qzuser_pure

@wwwab  这个文件是在什么环境提取的啊，有游戏软件嘛

tdsskiller

@wowocock