Rootkit/Loader.e X2

anthonyqian

wwwab 发表于 2024-4-5 09:38
说实话，这批样本Sophos已经分析了十几天，快半个月了

确认已经转发给实验室，3.22

sophos已经不理我了，已读不回的那种

123456aaaafsdeg

1. 风险路径：C:\Users\Administrator\Desktop\hwmon1\hwmon1.sys, 病毒名：Rootkit/Loader.e, 病毒ID：97f29e1bfe8475c2, 处理结果：已处理，删除文件
   
2. 风险路径：C:\Users\Administrator\Desktop\hwmon1 (1)\hwmon1.sys, 病毒名：Rootkit/Loader.e, 病毒ID：97f29e1bfe8475c2, 处理结果：已处理，删除文件

复制代码

hhhq316

蜘蛛

安天

adware

ANY.LNK 发表于 2024-4-4 12:09
不知道是微软意识到这个问题了还是单纯的签名过期，最近这4个驱动的whql签名都是无效的
大概是加载不了了
...

这种过期的可以 调整系统的时间来还原到过期前的

yaokai815

火绒 瑞星 卡巴均kill all

wwwab

anthonyqian 发表于 2024-4-5 15:14
sophos已经不理我了，已读不回的那种

Sophos分析了二十天，终于有结论了

Hi Team,

Sophos Labs has reviewed your sample and have determined the following:

File states:
hwperf (2).sys
7ed40eedda754339e55728ab100286235353ff1a
File Type: application/x-dosexec: Windows (TFT/EXE-A)
Size: 178520 bytes
Identity Associated: New Detection: Mal/Rootkit-NT


hwperf 2.sys
35ed2e0ff9aecd8afe9450a46ff7c2690caf9507
File Type: application/x-dosexec: Windows (TFT/EXE-A)
Size: 178520 bytes
Identity Associated: New Detection: Mal/Rootkit-NT

hwperf.sys
48818a60c60f99ae3baaef479392b4196d5adb05
File Type: application/x-dosexec: Windows (TFT/EXE-A)
Size: 178520 bytes
Identity Associated: New Detection: Mal/Rootkit-NT

hwperf3.sys
49153dc3fb63cdfa8300115ff374fb08bfe11f08
File Type: application/x-dosexec: Windows (TFT/EXE-A)
Size: 178520 bytes
Identity Associated: New Detection: Mal/Rootkit-NT

hwperf4.sys
3c1cc6953f2bc37bdfb6bf8d2449dbbd35c426c2
File Type: application/x-dosexec: Windows (TFT/EXE-A)
Size: 178520 bytes
Identity Associated: New Detection: Mal/Rootkit-NT

This means that after the investigation and analysis of the file, Sophos Labs has concluded that the sample submitted is  malicious,  showing malicious behavior and properties.

This ticket will now be closed. If you have further queries, please let us know by creating a new sample ase.
Have a great day.

anthonyqian

wwwab 发表于 2024-4-11 19:01
Sophos分析了二十天，终于有结论了

检测强度咋样

偶偶偶114514

wwwab 发表于 2024-4-11 19:01
Sophos分析了二十天，终于有结论了

附个翻译：
尊敬的xxx，

Sophos实验室已对您提交的样本进行了分析，得出以下结论：

文件状态: hwperf (2).sys7ed40eedda754339e55728ab100286235353ff1a
文件类型: application/x-dosexec: Windows (TFT/EXE-A)
大小: 178520字节
检出名: Associated: New Detection: Mal/Rootkit-NT

文件状态: hwperf 2.sys35ed2e0ff9aecd8afe9450a46ff7c2690caf9507
文件类型: application/x-dosexec: Windows (TFT/EXE-A)
大小：178520字节
检出名：同上

文件状态：hwperf.sys48818a60c60f99ae3baaef479392b4196d5adb05
文件类型 : application/x-dosexec : Windows(TFT/EXE-A)
大小 : 178520 字节
检出名 ：同上

经过分析，Sophos实验室得出结论，您所提交的样本具有恶意行为。
因此，我们将关闭此工单。如有任何疑问，请通过创建一个新的示例来告知我们。

祝您度过愉快的一天。

总结：拉黑了