MedusaLocker加壳测试

你开心就好

隔山打空气 发表于 2024-6-23 12:22
不能确保正常运行的话意义就少了很多（

之前确实有不少为了免杀套壳结果憋死了（损坏

这种的 应该就属于不管病毒死活 为加壳而加壳

winter0203

我刚刚试了下在实体机运行 全部都打开失败 目前电脑一切正常

user114514

蜘蛛扫描6Trojan.DownLoader33.34694
Trojan.DownLoader33.34694
BackDoor.Bifrost.15005
Trojan.Inject3.4985
Trojan.DownLoader33.34694
Trojan.DownLoader33.34694

Checking: packed.zip
Engine version: 7.0.65.5230
Total virus-finding records: 12029639
File size: 9.05 MB
File MD5: ab6ee76140dc11a8c85e7b2e41c6f3c3

packed.zip - archive ZIP
>packed.zip/packed/packed/medusa.exe infected with Trojan.DownLoader33.34694
>packed.zip/packed/packed/medusa_aspack.exe packed by FLY-CODE
>>packed.zip/packed/packed/medusa_aspack.exe infected with Trojan.DownLoader33.34694
>packed.zip/packed/packed/medusa_encryptEXE.exe infected with BackDoor.Bifrost.15005
>packed.zip/packed/packed/medusa_enigma.exe packed by ENIGMA
>>packed.zip/packed/packed/medusa_enigma.exe packed by FLY-CODE
>>>packed.zip/packed/packed/medusa_enigma.exe packed by BINARYRES
>>>>packed.zip/packed/packed/medusa_enigma.exe infected with Trojan.Inject3.4985
>packed.zip/packed/packed/medusa_upx.exe packed by UPX
>>packed.zip/packed/packed/medusa_upx.exe infected with Trojan.DownLoader33.34694
>packed.zip/packed/packed/medusa_vmp.exe - Ok
>packed.zip/packed/packed/medusa_zprotect.exe packed by PESTUB
>>packed.zip/packed/packed/medusa_zprotect.exe packed by PESTUB
>>>packed.zip/packed/packed/medusa_zprotect.exe packed by FLY-CODE
>>>>packed.zip/packed/packed/medusa_zprotect.exe packed by ZPROTECT
>>>>>packed.zip/packed/packed/medusa_zprotect.exe infected with Trojan.DownLoader33.34694

BitterLotus

DI All

haol

Avira found 7 threats as below

packed.zip/medusa.exe        TR/FileCoder.mbmgm
packed.zip/medusa_aspack.exe        TR/Crypt.ASPM.Gen
packed.zip/medusa_encryptEXE.exe        HEUR/AGEN.1363722
packed.zip/medusa_enigma.exe        HEUR/AGEN.1314144
packed.zip/medusa_upx.exe        HEUR/AGEN.1314840
packed.zip/medusa_vmp.exe        TR/Redcap.qfztc
packed.zip/medusa_zprotect.exe        TR/AVI.MedusaLocker.hgyul

DisaPDB

你开心就好 发表于 2024-6-23 12:53
https://mp.weixin.qq.com/s/DDp0EqzSnmFZAHMYuEWjLw
那也就是说 这种 也就是带壳取特征啦？

VMP只是通用机脱不了，你真要手动算偏移量修IAT那当然没问题
但是也要很高的技术力

Dream-XJ

BEST 清空

00006666

你开心就好 发表于 2024-6-23 12:53
https://mp.weixin.qq.com/s/DDp0EqzSnmFZAHMYuEWjLw
那也就是说 这种 也就是带壳取特征啦？

这种不能算是脱壳，火绒脱壳并不能把VMP加壳还原到原始代码，但是它可以获取一些查杀特征

你开心就好

00006666 发表于 2024-6-23 14:41
这种不能算是脱壳，火绒脱壳并不能把VMP加壳还原到原始代码，但是它可以获取一些查杀特征

涨知识了
但是他们（厂商）那边写脱壳 而且举例专门针对VMP壳保护的驱动

你开心就好

DisaPDB 发表于 2024-6-23 13:54
VMP只是通用机脱不了，你真要手动算偏移量修IAT那当然没问题
但是也要很高的技术力

谢谢 长见识了