farfli 50x

202125

wwwab 发表于 2025-1-5 19:00
全是Themida加壳？

set suspicious applications reporting to aggressive:
https://help.eset.com/essp/17/en-US/idh_config_protections.html

Suspicious applications—Includes programs compressed with packers or protectors. These types of protectors are often exploited by malware authors to evade detection.

Themida packer 50x:

1/5/2025 1:32:05 PM;F:\virus\farfli\JKnYSgUCEg.exe;2.6 MB;a variant of Win32/Packed.Themida.AGR suspicious application;1;DESKTOP-GMPJ8HA\avtest;104D8099943F8ECB1E9AE97D2312D0E212DBF3EE



inner payload:
1/5/2025 1:02:16 PM;Advanced memory scanner;file;Operating memory » JKnYSgUCEg.exe(25676);a variant of Win32/Farfli.DAV trojan;contained infected files;;;01A97439695960EDD3D343815523EB2920C789DF;

lsop1349987

ZA解压+扫描 kill 49 剩余1运行ZA无反应

zyx9

MES  kill  all
按访问扫描  kill一部分，剩余双击Real Protect kill

UNknownOoo

随便选了10个样本打包发给ESET并取得回复：

Thank you for your submission.
The detection for this threat will be included in the next update of detection engine, expected version: 30500.

1vviqkX.exe - Win32/Agent.AHBB trojan
2a0Dkh.exe - Win32/Agent.AHBB trojan
52MaVHr.exe - Win32/Agent.AHBB trojan
5wpXU7by.exe - Win32/Agent.AHBB trojan
6kD0JGYk.exe - Win32/Agent.AHBB trojan
6OuyLkmkc.exe - Win32/Agent.AHBB trojan
87q5Ciw.exe - Win32/Agent.AHBB trojan
9LB4TOv.exe - Win32/Agent.AHBB trojan
baJ9ux.exe - Win32/Agent.AHBB trojan
BrZRsn.exe - Win32/Agent.AHBB trojan

Regards,

ESET Malware Response Team

剩下的40枚样本通杀覆盖情况可以自己测试下

biue

腾讯电脑管家 49X

病毒搜集者

UNknownOoo 发表于 2025-1-5 16:03
不是你的环境问题，就是扫不出来

这效果，针对性免杀？