VT扫描结果1杀，ESET首杀，文件有Shanghai Liuran Trading Co.数字签名[奇特的小东西]

驭龙

Jirehlov1234 发表于 2024-9-15 06:19
龙大上哪找的样本这种东西观察下发链应该能看出端倪

网盘里随便翻到的，没有更多内容了

呼啸山庄

驭龙 发表于 2024-9-15 00:26
难道真的是威胁？金山和360的分析都有问题，可卡巴却分析没问题，这小东西挺特别啊

opentip上submit to reanalyze了。今晚看看会不会拉黑或给我个回复了。

驭龙

呼啸山庄 发表于 2024-9-15 08:14
opentip上submit to reanalyze了。今晚看看会不会拉黑或给我个回复了。

尘埃落定了，MDE上报的分析结果显示威胁
Researcher comment
We have reviewed the files and added malware detections for them to the next definition update. The latest definition information is available here: https://docs.microsoft.com/microsoft-365/security/defender-endpoint/manage-updates-baselines-microsoft-defender-antivirus Thank you for contacting Microsoft.

御坂14857号

360 实体机运行几秒后拦截

biue

腾讯电脑管家 1X

awsl10000次

驭龙 发表于 2024-9-15 08:24
尘埃落定了，MDE上报的分析结果显示威胁
Researcher comment
We have reviewed the files and added ma ...

wow...eset的自动机居然这么猛

Fadouse

Event: Malicious object detected
User: NT AUTHORITY\SYSTEM
User type: System user
Application name: DeepStaticService.exe
Application path: C:\Program Files\DeepInstinct
Component: File Anti-Virus
Result description: Detected
Type: Trojan
Name: Backdoor.Win32.Agent.myvelp
Precision: Exactly
Threat level: High
Object type: File
Object name: f_00217d
Object path: C:\Sandbox\fadou\VirusTest\user\current\AppData\Local\Chromium\User Data\Default\Cache\Cache_Data
MD5 of an object: ABAFCC40A335571B675B261293B07C3C
Reason: Databases
Databases release date: Today, 9/15/2024 8:42:00 AM

wwwab

Fadouse 发表于 2024-9-15 10:08
Event: Malicious object detected
User: NT AUTHORITY\SYSTEM
User type: System user

你这杀的是啥，14.26 MB，不是这个帖子的样本吧

Fadouse

wwwab 发表于 2024-9-15 10:11
你这杀的是啥，14.26 MB，不是这个帖子的样本吧

Sandboxie双击安装后浏览器下载的释放物

btbtg