银狐2X

ジ蓅暒划过づ

• VT首发6个报毒VirusTotal - File - f007bc6c53e2995f5490418fac761a64a88e30d1d145a67f3954b8966d8db154
• VT首发3个报毒VirusTotal - File - 003734348d05ac8087c497c214bd871355b168e41c9ee8d5aa5fcfcdbe6c8a89
• 卡巴扫描MISS KSN未知
• 样本：77777.zip - 蓝奏云
• 样本：88888.zip - 蓝奏云
  

班德就是我

ik特征可以阿

WGC_ZY

（连着99999也一并测了）
ESET扫描kill3x：
Scan Log
Version of detection engine: 32672 (20260211)
Date: 2/11/2026  Time: 10:32:42 PM
Scanned disks, folders and files: C:\Users\Zhang\Desktop\77777;C:\Users\Zhang\Desktop\88888;C:\Users\Zhang\Desktop\99999
User: DESKTOP-85GL5HT\Zhang
C:\Users\Zhang\Desktop\99999\99999.msi » MSI » disk1.cab » CAB » ThereD.dll - a variant of Win64/Agent_AGen.KGE trojan - action selection postponed until scan completion
C:\Users\Zhang\Desktop\99999\99999.msi » MSI » disk1.cab » CAB » resource.png » ZIP » Qt6Core.dll - a variant of Win64/Agent.IGE trojan - action selection postponed until scan completion
C:\Users\Zhang\Desktop\77777\77777.msi » MSI » disk1.cab » CAB » ThereD.dll - a variant of Win64/Agent_AGen.KGE trojan - action selection postponed until scan completion
C:\Users\Zhang\Desktop\77777\77777.msi » MSI » disk1.cab » CAB » resource.png » ZIP » UnityPlayer.dll - a variant of Win64/Agent.IGE trojan - action selection postponed until scan completion
C:\Users\Zhang\Desktop\88888\88888.exe » INDIGOROSE » %AppFolder%\R12.exe - a variant of Win32/GenKryptik.GXAW trojan - cleaned by deleting [1]
C:\Users\Zhang\Desktop\99999\99999.msi » MSI » disk1.cab » CAB » ThereD.dll - a variant of Win64/Agent_AGen.KGE trojan - deleted
C:\Users\Zhang\Desktop\99999\99999.msi » MSI » disk1.cab » CAB » resource.png » ZIP » Qt6Core.dll - a variant of Win64/Agent.IGE trojan - deleted
C:\Users\Zhang\Desktop\77777\77777.msi » MSI » disk1.cab » CAB » ThereD.dll - a variant of Win64/Agent_AGen.KGE trojan - deleted
C:\Users\Zhang\Desktop\77777\77777.msi » MSI » disk1.cab » CAB » resource.png » ZIP » UnityPlayer.dll - a variant of Win64/Agent.IGE trojan - deleted

Number of scanned objects: 62354
Number of detections: 5
Number of cleaned objects: 5
Time of completion: 10:34:16 PM  Total scanning time: 94 sec (00:01:34)

Notes:
[1] Object has been deleted as it only contained the virus body.

卡巴：
扫描不报。
77777.msi：双击后安装程序出现，之后PDM并开始回滚，最后把桌面上的快捷方式也删掉了，弹窗后删除掉MSI本体。
88888和99999：同上。

心醉咖啡

360扫描miss

LingGao

Microsoft Defender

“77777.msi”
Trojan:Script/Wacatac.C!ml

“88888.exe”
MISS，已提交分析。

Myrenaser

红伞清空
BDTS解压击杀88888.exe，另外，这个木马名，没见过