【归档】SilverFox/Injector 3x

Loyisa

BD 1x
724783b5c3f96a2bfc08c93ffab34eaf.exe 已感染 Gen:Variant.Lazy.630386

剩下两个ATC

桔梗想见雪

Loyisa 发表于 2024-12-13 14:52
BD 1x
724783b5c3f96a2bfc08c93ffab34eaf.exe 已感染 Gen:Variant.Lazy.630386

你的comodo呢

wowocock

银狐木马作者估计对卡饭是情有独钟，连注册的木马计划里都叫 kafanbbs
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CF1A5EF7-918F-4E5E-B015-16FB8064AC60}]
"Path"="\\kafanbbs"
"Hash"=hex:98,91,ae,12,00,2c,96,c2,e3,17,93,d1,4a,1b,4e,c8,1c,47,c5,c2,bb,a8,\
  21,7d,19,79,81,a0,13,ee,1b,6f
"Version"="1.0.0"
"Date"="2005-10-11T13:21:17-08:00"
"Author"="Microsoft Corporation"
"Description"="Microsoft"
"URI"="\\kafanbbs"
"Triggers"=hex:17,00,00,00,00,00,00,00,00,de,3f,05,a4,00,00,00,00,00,00,00,00,\
  00,00,00,00,de,3f,05,a4,00,00,00,ff,ff,ff,ff,ff,ff,ff,ff,48,05,41,03,48,48,\
  48,48,78,2a,c1,80,48,48,48,48,0e,00,00,00,48,48,48,48,53,00,79,00,73,00,74,\
  00,65,00,6d,00,00,00,48,48,00,00,00,00,48,48,48,48,00,48,48,48,48,48,48,48,\
  00,48,48,48,48,48,48,48,01,00,00,00,48,48,48,48,1c,00,00,00,48,48,48,48,01,\
  05,00,00,00,00,00,05,15,00,00,00,c6,2a,f3,df,53,72,31,d8,e8,0e,fc,3b,e9,03,\
  00,00,48,48,48,48,38,00,00,00,48,48,48,48,44,00,45,00,53,00,4b,00,54,00,4f,\
  00,50,00,2d,00,4d,00,4f,00,34,00,50,00,36,00,47,00,31,00,5c,00,4c,00,69,00,\
  68,00,6f,00,6e,00,67,00,6c,00,69,00,6e,00,00,00,32,00,00,00,2c,00,00,00,48,\
  48,48,48,00,00,00,00,ff,ff,ff,ff,00,00,00,00,ff,ff,ff,ff,07,00,00,00,3c,00,\
  00,00,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,48,48,48,\
  48,aa,aa,00,00,00,00,00,00,00,de,3f,05,a4,00,00,00,00,00,00,00,00,00,00,00,\
  00,de,3f,05,a4,00,00,00,ff,ff,ff,ff,ff,ff,ff,ff,00,00,00,00,ff,ff,ff,ff,00,\
  00,00,00,00,00,00,00,00,00,00,00,00,02,00,00,01,00,65,00,78,00,65,00,22,00,\
  20,00,53,00,74,00,00,00,00,00,48,48,48,48,00,48,48,48,48,48,48,48,00,48,48,\
  48,48,48,48,48,01,00,00,00,48,48,48,48,1c,00,00,00,48,48,48,48,01,05,00,00,\
  00,00,00,05,15,00,00,00,c6,2a,f3,df,53,72,31,d8,e8,0e,fc,3b,e9,03,00,00,48,\
  48,48,48,38,00,00,00,48,48,48,48,44,00,45,00,53,00,4b,00,54,00,4f,00,50,00,\
  2d,00,4d,00,4f,00,34,00,50,00,36,00,47,00,31,00,5c,00,4c,00,69,00,68,00,6f,\
  00,6e,00,67,00,6c,00,69,00,6e,00,00,00,32,00,00,00
"Actions"=hex:03,00,0c,00,00,00,53,00,79,00,73,00,74,00,65,00,6d,00,66,66,00,\
  00,00,00,18,00,00,00,72,00,75,00,6e,00,64,00,6c,00,6c,00,33,00,32,00,2e,00,\
  65,00,78,00,65,00,80,00,00,00,22,00,43,00,3a,00,5c,00,50,00,72,00,6f,00,67,\
  00,72,00,61,00,6d,00,20,00,46,00,69,00,6c,00,65,00,73,00,20,00,28,00,78,00,\
  38,00,36,00,29,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,20,00,4e,\
  00,54,00,5c,00,75,00,70,00,64,00,61,00,74,00,34,00,2e,00,76,00,61,00,63,00,\
  22,00,2c,00,44,00,6c,00,6c,00,52,00,65,00,67,00,69,00,73,00,74,00,65,00,72,\
  00,53,00,65,00,72,00,76,00,65,00,72,00,00,00,00,00,00,00
"DynamicInfo"=hex:03,00,00,00,c6,63,f3,92,0e,4d,db,01,27,72,6c,f5,26,4d,db,01,\
  00,00,00,00,00,00,00,00,ff,92,58,da,26,4d,db,01

Loyisa

桔梗想见雪 发表于 2024-12-13 14:59
你的comodo呢

卡 换了

swizzer

All~

1. 2024/12/13 17:26
   
2. 已阻止有害文件
   
3. 路径： C:\Users\yuzus\Desktop\3x-Saved(24-12-13)
   
4. 文件： 5765927e6cd8dfe4d57f4d0e71fd8b07.exe
   
5. 原因： Drop.Win64.MemAllocProcess.100

复制代码

1. 2024/12/13 17:26
   
2. 已隔离有害文件
   
3. 路径： C:\Users\yuzus\Desktop\3x-Saved(24-12-13)
   
4. 文件： 724783b5c3f96a2bfc08c93ffab34eaf.exe
   
5. 原因： TR/Redcap.b9391d

复制代码

1. 2024/12/13 17:25
   
2. 已隔离有害文件
   
3. 路径： C:\Users\yuzus\Desktop\3x-Saved(24-12-13)
   
4. 文件： 691514936d1809abf77d03c3df7a1460.exe
   
5. 原因： HEUR/APC

复制代码

UNknownOoo

火绒
扫描：ALL

1. 病毒详情：
   
2. 风险路径：C:\Users\UnknownOoo\Downloads\3x-Saved(24-12-13)\724783b5c3f96a2bfc08c93ffab34eaf.exe, 病毒名：TrojanDownloader/Lotok.cu, 病毒ID：a7d99fd3bbe6bb81, 处理结果：暂不处理
   
3. 风险路径：C:\Users\UnknownOoo\Downloads\3x-Saved(24-12-13)\5765927e6cd8dfe4d57f4d0e71fd8b07.exe, 病毒名：TrojanDownloader/Lotok.cu, 病毒ID：90850c2fe86f44fa, 处理结果：暂不处理
   
4. 风险路径：C:\Users\UnknownOoo\Downloads\3x-Saved(24-12-13)\691514936d1809abf77d03c3df7a1460.exe, 病毒名：TrojanDownloader/Lotok.cu, 病毒ID：90850c2fe86f44fa, 处理结果：暂不处理
   

复制代码

冰盾
ALL

DisaPDB

UNknownOoo 发表于 2024-12-13 17:43
火绒
扫描：ALL

冰盾这个拦截点稍微偏后了，拦截的是分配目标进程内存&Shellcode写入
激进一点的话，劫持特定类型句柄（工作工厂、I/O完成、定时器等）的操作就可以拦截了

martin1230

Dr.web x1 724783b5c3f96a2bfc08c93ffab34eaf.exe

UNknownOoo

DisaPDB 发表于 2024-12-13 17:49
冰盾这个拦截点稍微偏后了，拦截的是分配目标进程内存&Shellcode写入
激进一点的话，劫持特定类型句柄（ ...

可能是误报方面不好控制吧？还有它似乎把写内存操作都定义为ShellCode注入了（不管被写入内存区域的属性是什么）

DisaPDB

UNknownOoo 发表于 2024-12-13 18:04
可能是误报方面不好控制吧？还有它似乎把写内存操作都定义为ShellCode注入了（不管被写入内存区域的属性 ...

那可能就是单NtWriteVurtualMemory进行拦截了
那这不是误报更高吗，正常软件反而不会劫持线程工厂（）