我也发个新鲜出炉的样本，应该是银狐，首传VT是15杀

驭龙

VT首传15杀，应该是银狐新品种，搜索引擎搜到的
https://www.virustotal.com/gui/f ... b84f44794/detection



ESET无所畏惧
2024/12/20 19:20:14;HTTP filter;file;软件包安装.zip?v=3.6.1.6;a variant of Win64/Agent.DML.gen trojan;connection terminated;Event occurred during an attempt to access the web by the application: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe (0A9E517D93A94245C765BE2205EE71F079DFFF76).;466806882DE8E4FCDCC2C8D16DF62F7A8CF5C4A9;

深信服的报毒名真的是好有趣，妥妥的银狐名
Sangfor Engine Zero
Trojan.Win32.Save.SilverFox_RunShellCod

haol

Avira found TR/Agent.wwxtc

ongarabazanade

zyx9

心醉咖啡

火绒

ジ蓅暒划过づ

龙大居然双击了

inhh1

高级威胁防护已开始对恶意进程执行清除操作。进程路径: C:\Users\uuu\Desktop\软件包安装.exe. 威胁名称: ATC.SuspiciousBehavior.1727F36E43A39949.

Fadouse

KES UDS

1. Event: Malicious object detected
   
2. Component: File Threat Protection
   
3. Result description: Detected
   
4. Type: Trojan
   
5. Name: UDS:Trojan.Win32.Agent
   
6. Precision: Exactly
   
7. Threat level: High
   
8. Object type: File
   
9. Object name: 软件包安装.exe
   
10. Object path: C:\Users\fadou\AppData\Local\Temp\7zE82C1DCE7
    
11. SHA256 of an object: 2255BDAF12D38FDFC5D8DA1DE468D53C3175AA6710476A7C0BAAD72B84F44794
    
12. MD5 of an object: 3550D54947D144C47C8AA00D38412668
    
13. Reason: Cloud Protection

复制代码

Renascence

SEP落地杀

驭龙

ジ蓅暒划过づ 发表于 2024-12-20 20:33
龙大居然双击了

没双击啊，是下载的时候，流量监控杀的，我关闭文件监控，关闭文档保护，关闭流量监控，才下载下来病毒