trojan dropper 1x vt首发5/56

ulyanov2233

https://wormhole.app/4xLBnX#AFxYNyOtZrH9i53GanDe4Q
【SGpysrf.13.10.6.Stuep.rar】
链接：https://qfile.qq.com/q/iiyIjauly2
https://www.virustotal.com/gui/f ... 829cbd992?nocache=1

对对对对

KSN未知，双击回滚并且带走本体
事件: 对象已删除
用户: NT AUTHORITY\SYSTEM
用户类型: 系统用户
应用程序名称: msiexec.exe
应用程序路径: C:\Windows\System32
组件: 文件反病毒
结果描述: 已删除
类型: 木马
名称: HEUR:Backdoor.Win32.nimpl.a
精确度: 启发式分析
威胁级别: 高
对象类型: 文件
对象名称: data_file.png
对象路径: C:\Program Files (x86)\Sogoushurufa_3.1.15_setup\Sogoushurufa_3.1.15_setup\Startup Applications
对象的 MD5: 422C0D19F24759C2A2771561571589FD
火绒阻止了一堆软件安装，包括搜狗输入法等

请叫我德玛西亚

奇安信  双击miss

LSPD

360

UNknownOoo

火绒
运行：多步主防捉&内存防护捉

1. 防护项目：流行病毒
   
2. 可疑文件：HKEY_LOCAL_MACHINE\SOFTWARE\IpDates_info
   
3. 操作结果：已阻止
   

复制代码

1. 病毒名称：Backdoor/Lotok.UC
   
2. 病毒路径：C:\Program Files (x86)\Sogoushurufa_3.1.15_setup\Sogoushurufa_3.1.15_setup\Startup Applications\installer.exe
   
3. 操作结果：已处理，删除文件
   

复制代码

1. 病毒名称：Backdoor/Lotok.fs
   
2. 病毒ID：C284CCDE13F78515
   
3. 虚拟地址：0x0000000010000000
   
4. 映像大小：136KB
   
5. 是否完整映像：否
   
6. 数据流哈希：ee229551
   
7. 操作结果：处理失败，进程结束失败
   
8. 进程ID：9912
   
9. 操作进程：C:\Program Files (x86)\Sogoushurufa_3.1.15_setup\Sogoushurufa_3.1.15_setup\Startup Applications\installer.exe
   

复制代码

lingchenheiye

火绒扫描miss

munsimli

Emsisoft雙擊殺衍生物，本體不殺，附帶下載了搜狗安裝程式不殺

Curve25519

ESET Smart Security Premium 解压没反应，扫描kill，安装后监控也kill（不知道是否全部衍生物都kill了）。

扫描日志
检测引擎的版本: 31640 (20250804)
日期: 2025/8/5  时间: 11:38:29
已扫描的磁盘、文件夹和文件: W:\Sandbox\Admin\DefaultBox\drive\W\SGpysrf.13.10.6.Stuep\SGpysrf.13.10.6.Stuep.msi
用户: DESKTOP-K07940I\Admin
W:\Sandbox\Admin\DefaultBox\drive\W\SGpysrf.13.10.6.Stuep\SGpysrf.13.10.6.Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > aegis.min.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SGpysrf.13.10.6.Stuep\SGpysrf.13.10.6.Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/304_a592486.chunk.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SGpysrf.13.10.6.Stuep\SGpysrf.13.10.6.Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/474_0e262ed.chunk.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SGpysrf.13.10.6.Stuep\SGpysrf.13.10.6.Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/6_12770df.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SGpysrf.13.10.6.Stuep\SGpysrf.13.10.6.Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/7_3f88f33.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SGpysrf.13.10.6.Stuep\SGpysrf.13.10.6.Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/8_5866cc4.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SGpysrf.13.10.6.Stuep\SGpysrf.13.10.6.Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/9_f86c4dc.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SGpysrf.13.10.6.Stuep\SGpysrf.13.10.6.Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/aidraw_9807e73.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SGpysrf.13.10.6.Stuep\SGpysrf.13.10.6.Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/airead_215f357.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SGpysrf.13.10.6.Stuep\SGpysrf.13.10.6.Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/bg_68d2e93.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SGpysrf.13.10.6.Stuep\SGpysrf.13.10.6.Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/exit-imgs_0bd4532.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SGpysrf.13.10.6.Stuep\SGpysrf.13.10.6.Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/logo-big_3db1ae7.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SGpysrf.13.10.6.Stuep\SGpysrf.13.10.6.Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/new-sogou-logo-sider_974aed6.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SGpysrf.13.10.6.Stuep\SGpysrf.13.10.6.Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/setting-select_6423fe6.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SGpysrf.13.10.6.Stuep\SGpysrf.13.10.6.Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/pages/main_31dbb79.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SGpysrf.13.10.6.Stuep\SGpysrf.13.10.6.Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > index.html - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SGpysrf.13.10.6.Stuep\SGpysrf.13.10.6.Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > polyfill.min.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SGpysrf.13.10.6.Stuep\SGpysrf.13.10.6.Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > react-dom.production.min.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SGpysrf.13.10.6.Stuep\SGpysrf.13.10.6.Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > react-router-dom.production.min.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SGpysrf.13.10.6.Stuep\SGpysrf.13.10.6.Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > react.production.min.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SGpysrf.13.10.6.Stuep\SGpysrf.13.10.6.Stuep.msi > MSI > disk1.cab > CAB > installer.exe - ML/Augur 特洛伊木马 - 已保留
已扫描的对象数: 2487
检测数: 1
已清除的对象数: 0
完成时间: 11:39:05  总扫描时间: 36 秒 (00:00:36)

-----------------------------------------------------------------------
沙盘中双击安装，监控杀（不确定是否全部清除）

2025/8/5 11:39:38;文件系统实时防护;文件;\Device\TweakCubeRamDisk0\Sandbox\Admin\DefaultBox\drive\C\Program Files (x86)\Sogoushurufa_3.1.15_setup\Sogoushurufa_3.1.15_setup\Startup Applications\installer.exe;ML/Augur 特洛伊木马;已通过删除清除;DESKTOP-K07940I\Admin;在通过应用程序创建的新文件上发生了事件: C:\Windows\System32\msiexec.exe (0E8B428B24AE565B8E23DEA2057112F159C76312).;A8DC03D03DD47061221C096DEFBCB7D245CC2C42;2025/8/2 14:50:46
2025/8/5 11:42:36;文件系统实时防护;文件;\Device\TweakCubeRamDisk0\Sandbox\Admin\DefaultBox\drive\C\Program Files (x86)\Sogoushurufa_3.1.15_setup\Sogoushurufa_3.1.15_setup\Startup Applications\installer.exe;ML/Augur 特洛伊木马;已通过删除清除;DESKTOP-K07940I\Admin;在通过应用程序创建的新文件上发生了事件: C:\Windows\System32\msiexec.exe (0E8B428B24AE565B8E23DEA2057112F159C76312).;A8DC03D03DD47061221C096DEFBCB7D245CC2C42;2025/8/2 14:50:46

biue

腾讯电脑管家 1X