FakeApp 12x

xiaozhu009

https://pan.zhuzhu009.top/s/Rysk
https://qfile.qq.com/q/aUB1VP047e



火绒5x，exe都没扫出来，没试双击

22222221

elastic kill  all

莒县小哥

卡巴扫描杀9枚

Alexander1026

360杀毒。全杀

Myrenaser

avast扫描剩余 x1

a2650183122

卡巴扫描加双击全杀

成顔

BEST 扫6，双击如图。gugooulio双击后触发沙盒分析men.exe，报未发现。手动双击men.exe处理了三个文件并触发沙盒分析StartMenuExperienceHostker.exe，随后该进程被隔离。NeteaseCloudMusic_hgsdfg.exe和setupbeta_jisu.exe双击结果与SodaMusic-v2.9.1_x64相同。

WGC_ZY

ESET扫描全kill：
Scan Log
Version of detection engine: 32683 (20260213)
Date: 2/13/2026  Time: 5:40:38 PM
Scanned disks, folders and files: C:\Users\Zhang\Desktop\SodaMusic-v2.9.1_x64.exe;C:\Users\Zhang\Desktop\WangYiYun_setup_x86_v1.4.24.exe;C:\Users\Zhang\Desktop\WinRARsetup.exe;C:\Users\Zhang\Desktop\X64360Rar_v1766744719.9131566.msi;C:\Users\Zhang\Desktop\youdaoX64_win_v1.4.2.5.exe;C:\Users\Zhang\Desktop\google+chome+win10-11_456611_3.1.2_1.msi;C:\Users\Zhang\Desktop\google_Broswer_2026.02.12.msi;C:\Users\Zhang\Desktop\google_chome_win7-11_v1770357676.66816.msi;C:\Users\Zhang\Desktop\gugooulio.exe;C:\Users\Zhang\Desktop\HuorongSysDiagPro_v1769928477.6227355.msi;C:\Users\Zhang\Desktop\NeteaseCloudMusic_hgsdfg.exe;C:\Users\Zhang\Desktop\setupbeta_jisu.exe
User: DESKTOP-85GL5HT\Zhang
C:\Users\Zhang\Desktop\WangYiYun_setup_x86_v1.4.24.exe » INNO » file0000.bin » ZIP » men.b - error - password-protected file
C:\Users\Zhang\Desktop\WangYiYun_setup_x86_v1.4.24.exe » INNO » file0000.bin » ZIP » Server.log - error - password-protected file
C:\Users\Zhang\Desktop\WangYiYun_setup_x86_v1.4.24.exe » INNO » file0000.bin » ZIP » setup.exe - error - password-protected file
C:\Users\Zhang\Desktop\WinRARsetup.exe » INDIGOROSE » %AppFolder%\Setup.exe » INNO » {commonappdata}\44 - Win32/Agent.ACAM.Gen trojan - cleaned by deleting [1]
C:\Users\Zhang\Desktop\HuorongSysDiagPro_v1769928477.6227355.msi » MSI » disk1.cab » CAB » ThereD.dll - a variant of Win64/Agent_AGen.KGE trojan - action selection postponed until scan completion
C:\Users\Zhang\Desktop\HuorongSysDiagPro_v1769928477.6227355.msi » MSI » disk1.cab » CAB » resource.png » ZIP » liblzma-5.dll - a variant of Win64/Agent.IGE trojan - action selection postponed until scan completion
C:\Users\Zhang\Desktop\SodaMusic-v2.9.1_x64.exe » INDIGOROSE » %AppFolder%\Setup.exe » INNO » {commonappdata}\44 - Win32/Agent.ACAM.Gen trojan - cleaned by deleting [1]
C:\Users\Zhang\Desktop\google_Broswer_2026.02.12.msi » MSI » disk1.cab » CAB » ThereD.dll - a variant of Win64/Agent_AGen.KGE trojan - action selection postponed until scan completion
C:\Users\Zhang\Desktop\google_Broswer_2026.02.12.msi » MSI » disk1.cab » CAB » resource.png » ZIP » libcares-2.dll - a variant of Win64/Agent.IGE trojan - action selection postponed until scan completion
C:\Users\Zhang\Desktop\X64360Rar_v1766744719.9131566.msi » MSI » disk1.cab » CAB » ThereD.dll - a variant of Win64/Agent_AGen.KGE trojan - action selection postponed until scan completion
C:\Users\Zhang\Desktop\X64360Rar_v1766744719.9131566.msi » MSI » disk1.cab » CAB » resource.png » ZIP » liblzma-5.dll - a variant of Win64/Agent.IGE trojan - action selection postponed until scan completion
C:\Users\Zhang\Desktop\google+chome+win10-11_456611_3.1.2_1.msi » MSI » disk1.cab » CAB » ThereD.dll - a variant of Win64/Agent_AGen.KGE trojan - action selection postponed until scan completion
C:\Users\Zhang\Desktop\google+chome+win10-11_456611_3.1.2_1.msi » MSI » disk1.cab » CAB » resource.png » ZIP » gpShell.dll - a variant of Win64/Agent.IGE trojan - action selection postponed until scan completion
C:\Users\Zhang\Desktop\google_chome_win7-11_v1770357676.66816.msi » MSI » disk1.cab » CAB » ThereD.dll - a variant of Win64/Agent_AGen.KGE trojan - action selection postponed until scan completion
C:\Users\Zhang\Desktop\google_chome_win7-11_v1770357676.66816.msi » MSI » disk1.cab » CAB » resource.png » ZIP » libcares-2.dll - a variant of Win64/Agent.IGE trojan - action selection postponed until scan completion
C:\Users\Zhang\Desktop\gugooulio.exe » INNO » file0000.bin » ZIP » man30.dat - error - password-protected file
C:\Users\Zhang\Desktop\gugooulio.exe » INNO » file0000.bin » ZIP » men.b - error - password-protected file
C:\Users\Zhang\Desktop\gugooulio.exe » INNO » file0000.bin » ZIP » Server.log - error - password-protected file
C:\Users\Zhang\Desktop\gugooulio.exe » INNO » file0000.bin » ZIP » setup.exe - error - password-protected file
C:\Users\Zhang\Desktop\NeteaseCloudMusic_hgsdfg.exe » INDIGOROSE » %AppFolder%\Setup.exe » INNO » {commonappdata}\44 - Win32/Agent.ACAM.Gen trojan - cleaned by deleting [1]
C:\Users\Zhang\Desktop\youdaoX64_win_v1.4.2.5.exe » INNO » {app}\RunServer.dat - Win32/Rozena.BYP trojan - cleaned by deleting [1]
C:\Users\Zhang\Desktop\setupbeta_jisu.exe » INDIGOROSE » %AppFolder%\Setup.exe » INNO » {commonappdata}\44 - Win32/Agent.ACAM.Gen trojan - cleaned by deleting [1]
C:\Users\Zhang\Desktop\HuorongSysDiagPro_v1769928477.6227355.msi » MSI » disk1.cab » CAB » ThereD.dll - a variant of Win64/Agent_AGen.KGE trojan - deleted
C:\Users\Zhang\Desktop\HuorongSysDiagPro_v1769928477.6227355.msi » MSI » disk1.cab » CAB » resource.png » ZIP » liblzma-5.dll - a variant of Win64/Agent.IGE trojan - deleted
C:\Users\Zhang\Desktop\google_Broswer_2026.02.12.msi » MSI » disk1.cab » CAB » ThereD.dll - a variant of Win64/Agent_AGen.KGE trojan - deleted
C:\Users\Zhang\Desktop\google_Broswer_2026.02.12.msi » MSI » disk1.cab » CAB » resource.png » ZIP » libcares-2.dll - a variant of Win64/Agent.IGE trojan - deleted
C:\Users\Zhang\Desktop\X64360Rar_v1766744719.9131566.msi » MSI » disk1.cab » CAB » ThereD.dll - a variant of Win64/Agent_AGen.KGE trojan - deleted
C:\Users\Zhang\Desktop\X64360Rar_v1766744719.9131566.msi » MSI » disk1.cab » CAB » resource.png » ZIP » liblzma-5.dll - a variant of Win64/Agent.IGE trojan - deleted
C:\Users\Zhang\Desktop\google+chome+win10-11_456611_3.1.2_1.msi » MSI » disk1.cab » CAB » ThereD.dll - a variant of Win64/Agent_AGen.KGE trojan - deleted
C:\Users\Zhang\Desktop\google+chome+win10-11_456611_3.1.2_1.msi » MSI » disk1.cab » CAB » resource.png » ZIP » gpShell.dll - a variant of Win64/Agent.IGE trojan - deleted
C:\Users\Zhang\Desktop\google_chome_win7-11_v1770357676.66816.msi » MSI » disk1.cab » CAB » ThereD.dll - a variant of Win64/Agent_AGen.KGE trojan - deleted
C:\Users\Zhang\Desktop\google_chome_win7-11_v1770357676.66816.msi » MSI » disk1.cab » CAB » resource.png » ZIP » libcares-2.dll - a variant of Win64/Agent.IGE trojan - deleted

Number of scanned objects: 148356
Number of detections: 15
Number of cleaned objects: 15
Time of completion: 5:44:33 PM  Total scanning time: 235 sec (00:03:55)

Notes:
[1] Object has been deleted as it only contained the virus body.
卡巴：
扫描x10，双击x2

PhozeAMTB

WD all

Alexander1026

PhozeAMTB 发表于 2026-2-13 20:28
WD all

这个defender怎么古香古色的，怎么搞的