仿冒谷歌浏览器

hxxps://zh-chrome.com/

aikafans

eis网页不报，下载安装启动冰盾拦截（可执行文件伪装）。另外，avast高光时刻，解压杀

QVM360

https://www.virustotal.com/gui/f ... 612972f37?nocache=1

驭龙

Avira双击 没有反应 假浏览器都启动了

sentry明明工作的，可我双击一下午样本，没见过一个行为杀。

累了，我还是去看斩神吧，Avira在我这里是个假的

[2024-09-04 16:26:37.032] [info] [BaseScan] [thread id: 6808] [ProtectionCloud] The file '\\?\C:\Sandbox\ltqi\DefaultBox\drive\C\Goole Chrome2.11.2.3 wf2t\res\CKeyboardH.dll' was unknown in the Protection Cloud. SHA256: '6abbe723108eda7dfb00f263a625392b40c65984d9c26ff0a3d2c35612972f37' Requestor: 'RealtimeProtection' Flags: '{Upload needed}' Status: successful
[2024-09-04 16:26:37.327] [info] [BaseScan] [thread id: 6808] [ProtectionCloud] The file '\\?\C:\Sandbox\ltqi\DefaultBox\drive\C\Goole Chrome2.11.2.3 wf2t\res\CKeyboardH.dll' has been uploaded to the Protection Cloud and analyzed. SHA256: '6abbe723108eda7dfb00f263a625392b40c65984d9c26ff0a3d2c35612972f37' Requestor: 'RealtimeProtection' Flags: '' Status: successful
[2024-09-04 16:29:03.332] [info] [BaseScan] [thread id: 4476] [ProtectionCloud] The file '\\?\C:\Sandbox\ltqi\DefaultBox\user\current\AppData\Local\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe' was scanned with the Protection Cloud. SHA256: '7d5c0ed6617dbc1b78d2994a6e5bbda474b5f4814d4a34d41f844ce9a3a4eb66' Requestor: 'RealtimeProtection' Flags: '' Status: successful
[2024-09-04 16:29:05.249] [info] [RealTimeProtection] [thread id: 1992] [FileScan] Sentry Provided Info, Trusted installer stopped:C:\Sandbox\ltqi\DefaultBox\user\current\AppData\Local\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe, PiD:5996, ParentPid:9972
[2024-09-04 16:29:05.799] [info] [RealTimeProtection] [thread id: 1188] [FileScan] Sentry Provided Info, Trusted installer started:C:\Sandbox\ltqi\DefaultBox\user\current\AppData\Local\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe, PiD:11324, ParentPid:9972
[2024-09-04 16:29:05.881] [info] [BaseScan] [thread id: 4476] [ProtectionCloud] The file '\\?\C:\Sandbox\ltqi\DefaultBox\user\current\AppData\Local\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe' was scanned with the Protection Cloud. SHA256: '7d5c0ed6617dbc1b78d2994a6e5bbda474b5f4814d4a34d41f844ce9a3a4eb66' Requestor: 'RealtimeProtection' Flags: '' Status: successful
[2024-09-04 16:29:06.515] [info] [RealTimeProtection] [thread id: 7964] [FileScan] Sentry Provided Info, Trusted installer stopped:C:\Sandbox\ltqi\DefaultBox\user\current\AppData\Local\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe, PiD:11324, ParentPid:9972
[2024-09-04 16:29:06.991] [info] [RealTimeProtection] [thread id: 2480] [FileScan] Sentry Provided Info, Trusted installer started:C:\Sandbox\ltqi\DefaultBox\user\current\AppData\Local\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe, PiD:7896, ParentPid:9972
[2024-09-04 16:29:07.243] [info] [BaseScan] [thread id: 4476] [ProtectionCloud] The file '\\?\C:\Sandbox\ltqi\DefaultBox\user\current\AppData\Local\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe' was scanned with the Protection Cloud. SHA256: '7d5c0ed6617dbc1b78d2994a6e5bbda474b5f4814d4a34d41f844ce9a3a4eb66' Requestor: 'RealtimeProtection' Flags: '' Status: successful
[2024-09-04 16:29:08.265] [info] [RealTimeProtection] [thread id: 6060] [FileScan] Sentry Provided Info, Trusted installer stopped:C:\Sandbox\ltqi\DefaultBox\user\current\AppData\Local\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe, PiD:7896, ParentPid:9972
[2024-09-04 16:29:10.260] [info] [RealTimeProtection] [thread id: 792] [FileScan] Sentry Provided Info, Trusted installer stopped:C:\Sandbox\ltqi\DefaultBox\user\current\AppData\Local\Google\Update\GoogleUpdate.exe, PiD:9972, ParentPid:4852

玛姆库特

安装完成后，双击Goole Chrome，杀掉黑dll

swizzer

Kaspersky Free failed.






Update: 跑了1.5h后，后台扫描检测...亡羊补牢？

761773275

護士執行miss

aboringman

swizzer 发表于 2024-9-4 18:00
Kaspersky Free failed.

快速扫描，内存检测，治标不治本

1. 事件: 检测到恶意对象
   
2. 组件: 病毒扫描
   
3. 结果: 检测到
   
4. 结果说明: 检测到
   
5. 类型: 木马
   
6. 名称: MEM:Trojan.Win32.SEPEH.gen
   
7. 精确度: 确切
   
8. 威胁级别: 高
   
9. 对象类型: 文件
   
10. 对象名称: System Memory
    
11. 原因: 专家分析
    
12. 数据库发布日期: 今天，2024/9/4 18:03:00

复制代码

断簪

驭龙 发表于 2024-9-4 16:27
Avira双击 没有反应 假浏览器都启动了

sentry明明工作的，可我双击一下午样本，没见过一个行为杀。

云没连上吧

驭龙

断簪 发表于 2024-9-4 19:39
云没连上吧

你是什么系统，开内核隔离了吗。
云杀是有的
我系统23H2上无法开启sentryeye进程，
2024/09/03 12:26:22.292 | SentryEye disabled due to windows version.
2024/09/03 12:26:22.370 | Sentry engine activated
2024/09/03 12:26:22.370 | Sentry: Operational thread started.