利用杀软文件的样本 1X

UNknownOoo

火绒
扫描

1. 病毒详情：
   
2. 风险路径：C:\Users\UnknownOoo\Downloads\ToDesk_Setup.exe, 病毒名：TrojanDropper/Agent.vz, 病毒ID：85de1f266b3b32fa, 处理结果：暂不处理
   

复制代码

00006666

ジ蓅暒划过づ 发表于 2025-1-5 10:52
Vt那个sin杀软好像报的是银狐？

Sangfor Engine Zero 是深信服

ジ蓅暒划过づ

00006666 发表于 2025-1-5 11:04
Sangfor Engine Zero 是深信服

哦，英文名字没认出来。。哈哈

00006666

ジ蓅暒划过づ 发表于 2025-1-5 11:10
哦，英文名字没认出来。。哈哈

看介绍应该是AI引擎

https://blog.virustotal.com/2019 ... or-engine-zero.html

1. “Sangfor Engine Zero (a.k.a SAVE engine in China) is an AI-powered malware inspection engine developed by the Sangfor Security Team and in use at some of the most influential and forward thinking enterprises globally. Engine Zero utilizes machine learning technology to analyze and synthesize input data. The combined power of Sangfor’s dedicated R&D and Security teams, comprised of data scientists, security analysts and white hat researchers, has produced Engine Zero’s unique, multi-dimentional features, able to detect and classify malicious files, sight unseen. Engine Zero surpasses traditional detection engines (feature/hash based) in its ability to: 1. Ability to identify new and unknown malware with no updates to the AI model 2. Proven industry-leading ransomware detection capabilities (successfully detected WannaCry, Globelmposter, GandCrab, CrySiS and their families) 3. Integrate and work in conjunction with the highly-automated Neural-X, Sangfor’s AI-enabled cloud platform for threat intelligence & analytics, to self-evolve and self-teach without human intervention.”

复制代码

ジ蓅暒划过づ

00006666 发表于 2025-1-5 11:54
看介绍应该是AI引擎

https://blog.virustotal.com/2019 ... or-engine-zero.html

不过他这个英文直接写银狐，但是我感觉这个又不太像

biue

腾讯电脑管家 1X

woaimou

Avira扫描报HEUR/APC.Griffin

驭龙

00006666 发表于 2025-1-5 11:04
Sangfor Engine Zero 是深信服

这个深信服怎么报银狐了？按照这样本利用avast WSC组件注册安全中心来禁用MD的行为，不应该是银狐啊，银狐只针对MD？不太合理，它的针对重点不是卫士？难道还专门研究一个专门针对MD的独立类型？

00006666

驭龙 发表于 2025-1-5 14:22
这个深信服怎么报银狐了？按照这样本利用avast WSC组件注册安全中心来禁用MD的行为，不应该是银狐啊，银 ...

不好说，毕竟银狐团伙有那么多，银狐它就是个黑市木马，任何团伙买了就能用。

也有可能是AI引擎报错了

驭龙

00006666 发表于 2025-1-5 14:31
不好说，毕竟银狐团伙有那么多，银狐它就是个黑市木马，任何团伙买了就能用。

也有可能是AI引擎报错了

这个行为特征跟之前的银狐也不太一样，除非是C2是银狐的，要不然真看不出来是银狐。

或许是其他团队搞的新品种？我觉得单独针对MD这不太适合国内的环境吧，有一点得不偿失