疑似银狐 和衍生物

eroko

https://f.ws28.cn/f/eudmzzmflmg
Setup_BOC.4应该是本体
infected里面是请回来的小鬼

样本已经提交给猎鹰，工程师推测是银狐

123456aaaafsdeg

孤勇者

卡巴斯基kill all

woaimou

火绒高启发模式杀4X

1073328164

迈克菲扫描 kill 5x

骨灰级小白

毛豆入沙，程序报错

kkdy

360kill本体

金山毒霸全部查杀

傻猪猪米走鸡

Time;Scanner;Object type;Object;Detection;Action;User;Information;Hash;First seen here
8/15/2024 9:47:48 AM;Real-time file system protection;file;C:\Users\alphabutt\Downloads\¹«Ê¾Ãû¼ssetup_6006\公示名录ssetup_6006.exe;a variant of Win64/TrojanDownloader.Agent.AYE trojan;cleaned by deleting;GALAXYFC24\alphabutt;Event occurred on a new file created by the application: C:\Program Files\WindowsApps\40174MouriNaruto.NanaZip_3.0.1000.0_arm64__gnj4mf6z9tkrc\NanaZip.Windows.exe (0C55CB142EEFADC9884970BC3B8ED6F02FC07D9B).;48F5D882D6F1F9ABA2178BEEC9D3124E27C7E9A6;8/15/2024 9:47:44 AM
8/15/2024 9:49:55 AM;Real-time file system protection;file;C:\Users\alphabutt\Downloads\Setup_BOC.4等2个文件\infected\KA7wuF\utils.vcxproj;Win32/Farfli.COE.Gen trojan;cleaned by deleting;GALAXYFC24\alphabutt;Event occurred on a new file created by the application: C:\Program Files\WindowsApps\40174MouriNaruto.NanaZip_3.0.1000.0_arm64__gnj4mf6z9tkrc\NanaZip.Windows.exe (0C55CB142EEFADC9884970BC3B8ED6F02FC07D9B).;F23D96EE54423259D6A367E197E9D3C8A08FD354;8/15/2024 9:49:53 AM
8/15/2024 9:49:55 AM;Real-time file system protection;file;C:\Users\alphabutt\Downloads\Setup_BOC.4等2个文件\infected\FirewallInstallHelper.dll;a variant of Win64/Packed.VMProtect.X suspicious application;cleaned by deleting;GALAXYFC24\alphabutt;Event occurred on a new file created by the application: C:\Program Files\WindowsApps\40174MouriNaruto.NanaZip_3.0.1000.0_arm64__gnj4mf6z9tkrc\NanaZip.Windows.exe (0C55CB142EEFADC9884970BC3B8ED6F02FC07D9B).;C5B2651FA4005FEDB8683CA05A56E8418D20E6E2;8/15/2024 9:49:53 AM
8/15/2024 9:49:55 AM;Real-time file system protection;file;C:\Users\alphabutt\Downloads\Setup_BOC.4等2个文件\infected\JgP9ZC\utils.vcxproj;Win32/Farfli.COE.Gen trojan;cleaned by deleting;GALAXYFC24\alphabutt;Event occurred on a new file created by the application: C:\Program Files\WindowsApps\40174MouriNaruto.NanaZip_3.0.1000.0_arm64__gnj4mf6z9tkrc\NanaZip.Windows.exe (0C55CB142EEFADC9884970BC3B8ED6F02FC07D9B).;A799E7D4BAD22A5834220A84F47CF977A3D50E8D;8/15/2024 9:49:53 AM
8/15/2024 9:49:55 AM;Real-time file system protection;file;C:\Users\alphabutt\Downloads\Setup_BOC.4等2个文件\infected\JgP9ZC\SbieDll.dll;a variant of Win32/Packed.VMProtect.BB suspicious application;cleaned by deleting;GALAXYFC24\alphabutt;Event occurred on a new file created by the application: C:\Program Files\WindowsApps\40174MouriNaruto.NanaZip_3.0.1000.0_arm64__gnj4mf6z9tkrc\NanaZip.Windows.exe (0C55CB142EEFADC9884970BC3B8ED6F02FC07D9B).;017CFAD694D224316F86C5652D594AC2DA3305CC;8/15/2024 9:49:53 AM
8/15/2024 9:49:57 AM;Real-time file system protection;file;C:\Users\alphabutt\Downloads\Setup_BOC.4等2个文件\infected\KA7wuF\SbieDll.dll;a variant of Win32/Packed.VMProtect.BB suspicious application;cleaned by deleting;GALAXYFC24\alphabutt;Event occurred on a new file created by the application: C:\Program Files\WindowsApps\40174MouriNaruto.NanaZip_3.0.1000.0_arm64__gnj4mf6z9tkrc\NanaZip.Windows.exe (0C55CB142EEFADC9884970BC3B8ED6F02FC07D9B).;201CFE3F381DA2342E0DB1FBC8B2B9663E9F8495;8/15/2024 9:49:53 AM
8/15/2024 9:50:27 AM;Real-time file system protection;file;C:\Users\alphabutt\Downloads\Setup_BOC.4等2个文件\infected\a6i9IPQd\dzF7pO43.exe;a variant of Win64/CoinMiner.PR potentially unwanted application;cleaned by deleting;GALAXYFC24\alphabutt;Event occurred on a new file created by the application: C:\Program Files\WindowsApps\40174MouriNaruto.NanaZip_3.0.1000.0_arm64__gnj4mf6z9tkrc\NanaZip.Windows.exe (0C55CB142EEFADC9884970BC3B8ED6F02FC07D9B).;E5EBF8169D6B2485C0C3412AB137528136F96CA2;8/15/2024 9:49:53 AM



Time;Component;Event;User
8/15/2024 9:53:49 AM;ESET Kernel;Suspicious file 'Setup_BOC.4.exe' was sent to ESET Virus Lab for analysis.;SYSTEM

御坂14857号

智量 解压杀1x，双击测试默认拦截外联1x

1. Time                FilePath                                                                                           VirusName
   
2. 2024-08-15 10:23:06 C:\Users\VM\Desktop\infected\JgP9ZC\TBJFzi58.exe->47.238.156.11                                     事件: 访问网络  操作: 允许   
   
3. 2024-08-15 10:23:02 C:\Users\VM\Desktop\infected\JgP9ZC\TBJFzi58.exe->15.197.148.33                                     事件: 访问网络  操作: 允许   
   
4. 2024-08-15 10:19:46 C:\Users\VM\Desktop\infected\a6i9IPQd\dzF7pO43.exe                                                  Heur.ML.PE.E        
   

复制代码