虚假搜狗输入法病毒

00006666

虚假搜狗输入法病毒

https://c.wss.cc/f/hns4xspshr8

https://www.virustotal.com/gui/file/d5e36b9dfec2995e45bd978e45eb2254fc6f7d22863fadb396e28e0e3eacaba0/detection

https://s.threatbook.com/report/file/d5e36b9dfec2995e45bd978e45eb2254fc6f7d22863fadb396e28e0e3eacaba0

病毒网站汇总:https://bbs.kafan.cn/thread-2283786-1-1.html

fever腾腾

毒霸 miss

Rukia

Libcurl.dll
C:\Program Files (x86)\Sogoushurufa_3.1.15_setup\Sogoushurufa_3.1.15_setup\Startup Applications
https://www.virustotal.com/gui/f ... b819055164bc86b1b0e

installer.exe
C:\Program Files (x86)\Sogoushurufa_3.1.15_setup\Sogoushurufa_3.1.15_setup\Startup Applications
https://www.virustotal.com/gui/f ... b4e5605c7eeab980e0f

https://wormhole.app/QWpp4K#TTvFjrOsPASO_WTAU0IJjQ解压密码 infected

对对对对

kaba
事件: 检测到恶意对象
用户: DESKTOP-PP5PA97\Asd
用户类型: 发起者
应用程序名称: explorer.exe
应用程序路径: C:\Windows
组件: 文件反病毒
结果描述: 检测到
类型: 木马
名称: HEUR:Backdoor.Win32.nimpl.a
精确度: 启发式分析
威胁级别: 高
对象类型: 文件
对象名称: data_file.png
对象路径: C:\Users\Asd\Desktop
对象的 MD5: 422C0D19F24759C2A2771561571589FD
原因: 专家分析
数据库发布日期: 昨天，8/4/2025 5:13:00 PM

Curve25519

ESET Smart Security Premium 解压没反应，扫描杀

扫描日志
检测引擎的版本: 31641 (20250805)
日期: 2025/8/5  时间: 15:38:32
已扫描的磁盘、文件夹和文件: W:\Sandbox\Admin\DefaultBox\drive\W\SG_pysrf_3.20.18_Stuep\SG_pysrf_3.20.18_Stuep.msi
用户: DESKTOP-K07940I\Admin
W:\Sandbox\Admin\DefaultBox\drive\W\SG_pysrf_3.20.18_Stuep\SG_pysrf_3.20.18_Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > aegis.min.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SG_pysrf_3.20.18_Stuep\SG_pysrf_3.20.18_Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/304_a592486.chunk.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SG_pysrf_3.20.18_Stuep\SG_pysrf_3.20.18_Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/474_0e262ed.chunk.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SG_pysrf_3.20.18_Stuep\SG_pysrf_3.20.18_Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/6_12770df.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SG_pysrf_3.20.18_Stuep\SG_pysrf_3.20.18_Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/7_3f88f33.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SG_pysrf_3.20.18_Stuep\SG_pysrf_3.20.18_Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/8_5866cc4.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SG_pysrf_3.20.18_Stuep\SG_pysrf_3.20.18_Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/9_f86c4dc.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SG_pysrf_3.20.18_Stuep\SG_pysrf_3.20.18_Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/aidraw_9807e73.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SG_pysrf_3.20.18_Stuep\SG_pysrf_3.20.18_Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/airead_215f357.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SG_pysrf_3.20.18_Stuep\SG_pysrf_3.20.18_Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/bg_68d2e93.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SG_pysrf_3.20.18_Stuep\SG_pysrf_3.20.18_Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/exit-imgs_0bd4532.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SG_pysrf_3.20.18_Stuep\SG_pysrf_3.20.18_Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/logo-big_3db1ae7.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SG_pysrf_3.20.18_Stuep\SG_pysrf_3.20.18_Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/new-sogou-logo-sider_974aed6.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SG_pysrf_3.20.18_Stuep\SG_pysrf_3.20.18_Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/setting-select_6423fe6.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SG_pysrf_3.20.18_Stuep\SG_pysrf_3.20.18_Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/pages/main_31dbb79.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SG_pysrf_3.20.18_Stuep\SG_pysrf_3.20.18_Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > index.html - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SG_pysrf_3.20.18_Stuep\SG_pysrf_3.20.18_Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > polyfill.min.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SG_pysrf_3.20.18_Stuep\SG_pysrf_3.20.18_Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > react-dom.production.min.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SG_pysrf_3.20.18_Stuep\SG_pysrf_3.20.18_Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > react-router-dom.production.min.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SG_pysrf_3.20.18_Stuep\SG_pysrf_3.20.18_Stuep.msi > MSI > disk1.cab > CAB > sogou_pinyin_guanwang_15.6.exe > NSIS > ichat_1.0.2.2852.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > react.production.min.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\SG_pysrf_3.20.18_Stuep\SG_pysrf_3.20.18_Stuep.msi > MSI > disk1.cab > CAB > installer.exe - ML/Augur 特洛伊木马 - 已保留
已扫描的对象数: 2486
检测数: 1
已清除的对象数: 0
完成时间: 15:39:03  总扫描时间: 31 秒 (00:00:31)

UNknownOoo

火绒
运行：主防&内存防护捉

1. 防护项目：流行病毒
   
2. 可疑文件：HKEY_LOCAL_MACHINE\SOFTWARE\IpDates_info
   
3. 操作结果：已阻止
   

复制代码

1. 病毒名称：Backdoor/Lotok.UC
   
2. 病毒路径：C:\Program Files (x86)\Sogoushurufa_3.1.15_setup\Sogoushurufa_3.1.15_setup\Startup Applications\installer.exe
   
3. 操作结果：已处理，删除文件
   

复制代码

1. 病毒名称：Backdoor/Lotok.fs
   
2. 病毒ID：C284CCDE13F78515
   
3. 虚拟地址：0x0000000010000000
   
4. 映像大小：136KB
   
5. 是否完整映像：否
   
6. 数据流哈希：ee229551
   
7. 操作结果：处理成功，进程已结束
   
8. 进程ID：5664
   
9. 操作进程：C:\Program Files (x86)\Sogoushurufa_3.1.15_setup\Sogoushurufa_3.1.15_setup\Startup Applications\installer.exe
   

复制代码

lingchenheiye

火绒高启发下扫描仍然miss，火绒好像对大文件的沙箱运行检测效果不佳

biue

腾讯电脑管家 1X