FakeApp Rootkit，#Chrome #SilverFox

aikafans

fsp解压

文件：Inst.5322e53201.exe
原因：TR/W64.Agent

wowocock

用火绒恶意木马专杀干掉WDAC后再用火绒查杀即可。
禁止列表
  <Deny ID="ID_DENY_D_0001" FilePath="%OSDRIVE%\Program Files (x86)\360\360safe\360Safe.exe" />
    <Deny ID="ID_DENY_D_0002" FilePath="%OSDRIVE%\Program Files (x86)\360\360safe\deepscan\ZhuDongFangYu.exe" />
    <Deny ID="ID_DENY_D_0003" FilePath="%OSDRIVE%\Program Files (x86)\360\360safe\LiveUpdate360.exe" />
    <Deny ID="ID_DENY_D_0004" FilePath="%OSDRIVE%\Program Files (x86)\360\360safe\safemon\360Tray.exe" />
    <Deny ID="ID_DENY_D_0005" FilePath="%OSDRIVE%\Program Files (x86)\360\360safe\Utils\FileSmasher.exe" />
    <Deny ID="ID_DENY_D_0006" FilePath="%OSDRIVE%\Program Files (x86)\360\360sd\*" />
    <Deny ID="ID_DENY_D_0007" FilePath="%OSDRIVE%\Program Files (x86)\Avast*" />
    <Deny ID="ID_DENY_D_0008" FilePath="%OSDRIVE%\Program Files (x86)\AVG\*" />
    <Deny ID="ID_DENY_D_0009" FilePath="%OSDRIVE%\Program Files (x86)\Avira*" />
    <Deny ID="ID_DENY_D_000A" FilePath="%OSDRIVE%\Program Files (x86)\Bitdefender*" />
    <Deny ID="ID_DENY_D_000B" FilePath="%OSDRIVE%\Program Files (x86)\Common Files\Doctor Web*" />
    <Deny ID="ID_DENY_D_000C" FilePath="%OSDRIVE%\Program Files (x86)\Cybereason*" />
    <Deny ID="ID_DENY_D_000D" FilePath="%OSDRIVE%\Program Files (x86)\Cylance*" />
    <Deny ID="ID_DENY_D_000E" FilePath="%OSDRIVE%\Program Files (x86)\DeepInstinct\*" />
    <Deny ID="ID_DENY_D_000F" FilePath="%OSDRIVE%\Program Files (x86)\Doctor Web*" />
    <Deny ID="ID_DENY_D_0010" FilePath="%OSDRIVE%\Program Files (x86)\Elastic*" />
    <Deny ID="ID_DENY_D_0011" FilePath="%OSDRIVE%\Program Files (x86)\Emsisoft*" />
    <Deny ID="ID_DENY_D_0012" FilePath="%OSDRIVE%\Program Files (x86)\ESET\*" />
    <Deny ID="ID_DENY_D_0013" FilePath="%OSDRIVE%\Program Files (x86)\FireEye*" />
    <Deny ID="ID_DENY_D_0014" FilePath="%OSDRIVE%\Program Files (x86)\G Data*" />
    <Deny ID="ID_DENY_D_0015" FilePath="%OSDRIVE%\Program Files (x86)\HP\Sure*" />
    <Deny ID="ID_DENY_D_0016" FilePath="%OSDRIVE%\Program Files (x86)\Huorong\*" />
    <Deny ID="ID_DENY_D_0017" FilePath="%OSDRIVE%\Program Files (x86)\Kaspersky*" />
    <Deny ID="ID_DENY_D_0018" FilePath="%OSDRIVE%\Program Files (x86)\kingsoft\kingsoft antivirus\*" />
    <Deny ID="ID_DENY_D_0019" FilePath="%OSDRIVE%\Program Files (x86)\Lenovo\PCManager\*" />
    <Deny ID="ID_DENY_D_001A" FilePath="%OSDRIVE%\Program Files (x86)\Malwarebytes*" />
    <Deny ID="ID_DENY_D_001B" FilePath="%OSDRIVE%\Program Files (x86)\McAfee*" />
    <Deny ID="ID_DENY_D_001C" FilePath="%OSDRIVE%\Program Files (x86)\Norton*" />
    <Deny ID="ID_DENY_D_001D" FilePath="%OSDRIVE%\Program Files (x86)\Palo Alto*" />
    <Deny ID="ID_DENY_D_001E" FilePath="%OSDRIVE%\Program Files (x86)\Qianxin\Tianqing\*" />
    <Deny ID="ID_DENY_D_001F" FilePath="%OSDRIVE%\Program Files (x86)\Qualys*" />
    <Deny ID="ID_DENY_D_0020" FilePath="%OSDRIVE%\Program Files (x86)\Rising\REC\*" />
    <Deny ID="ID_DENY_D_0021" FilePath="%OSDRIVE%\Program Files (x86)\Sangfor\*" />
    <Deny ID="ID_DENY_D_0022" FilePath="%OSDRIVE%\Program Files (x86)\SentinelOne*" />
    <Deny ID="ID_DENY_D_0023" FilePath="%OSDRIVE%\Program Files (x86)\Sophos*" />
    <Deny ID="ID_DENY_D_0024" FilePath="%OSDRIVE%\Program Files (x86)\Tencent\QQPCMgr\*" />
    <Deny ID="ID_DENY_D_0025" FilePath="%OSDRIVE%\Program Files (x86)\Tianqing\*" />
    <Deny ID="ID_DENY_D_0026" FilePath="%OSDRIVE%\Program Files (x86)\Topsec\ESEndpoint\bin\*" />
    <Deny ID="ID_DENY_D_0027" FilePath="%OSDRIVE%\Program Files (x86)\Trend Micro*" />
    <Deny ID="ID_DENY_D_0028" FilePath="%OSDRIVE%\Program Files\360\360safe\360Safe.exe" />
    <Deny ID="ID_DENY_D_0029" FilePath="%OSDRIVE%\Program Files\360\360safe\deepscan\ZhuDongFangYu.exe" />
    <Deny ID="ID_DENY_D_002A" FilePath="%OSDRIVE%\Program Files\360\360safe\LiveUpdate360.exe" />
    <Deny ID="ID_DENY_D_002B" FilePath="%OSDRIVE%\Program Files\360\360safe\safemon\360Tray.exe" />
    <Deny ID="ID_DENY_D_002C" FilePath="%OSDRIVE%\Program Files\360\360safe\Utils\FileSmasher.exe" />
    <Deny ID="ID_DENY_D_002D" FilePath="%OSDRIVE%\Program Files\360\360sd\*" />
    <Deny ID="ID_DENY_D_002E" FilePath="%OSDRIVE%\Program Files\Avast*" />
    <Deny ID="ID_DENY_D_002F" FilePath="%OSDRIVE%\Program Files\AVG\*" />
    <Deny ID="ID_DENY_D_0030" FilePath="%OSDRIVE%\Program Files\Avira*" />
    <Deny ID="ID_DENY_D_0031" FilePath="%OSDRIVE%\Program Files\Bitdefender*" />
    <Deny ID="ID_DENY_D_0032" FilePath="%OSDRIVE%\Program Files\Common Files\Doctor Web*" />
    <Deny ID="ID_DENY_D_0033" FilePath="%OSDRIVE%\Program Files\Cybereason*" />
    <Deny ID="ID_DENY_D_0034" FilePath="%OSDRIVE%\Program Files\Cylance*" />
    <Deny ID="ID_DENY_D_0035" FilePath="%OSDRIVE%\Program Files\DeepInstinct\*" />
    <Deny ID="ID_DENY_D_0036" FilePath="%OSDRIVE%\Program Files\Doctor Web*" />
    <Deny ID="ID_DENY_D_0037" FilePath="%OSDRIVE%\Program Files\Elastic*" />
    <Deny ID="ID_DENY_D_0038" FilePath="%OSDRIVE%\Program Files\Emsisoft*" />
    <Deny ID="ID_DENY_D_0039" FilePath="%OSDRIVE%\Program Files\ESET\*" />
    <Deny ID="ID_DENY_D_003A" FilePath="%OSDRIVE%\Program Files\FireEye*" />
    <Deny ID="ID_DENY_D_003B" FilePath="%OSDRIVE%\Program Files\G Data*" />
    <Deny ID="ID_DENY_D_003C" FilePath="%OSDRIVE%\Program Files\HP\Sure*" />
    <Deny ID="ID_DENY_D_003D" FilePath="%OSDRIVE%\Program Files\Huorong\*" />
    <Deny ID="ID_DENY_D_003E" FilePath="%OSDRIVE%\Program Files\Kaspersky*" />
    <Deny ID="ID_DENY_D_003F" FilePath="%OSDRIVE%\Program Files\kingsoft\kingsoft antivirus\*" />
    <Deny ID="ID_DENY_D_0040" FilePath="%OSDRIVE%\Program Files\Lenovo\PCManager\*" />
    <Deny ID="ID_DENY_D_0041" FilePath="%OSDRIVE%\Program Files\Malwarebytes*" />
    <Deny ID="ID_DENY_D_0042" FilePath="%OSDRIVE%\Program Files\McAfee*" />
    <Deny ID="ID_DENY_D_0043" FilePath="%OSDRIVE%\Program Files\Norton*" />
    <Deny ID="ID_DENY_D_0044" FilePath="%OSDRIVE%\Program Files\Palo Alto*" />
    <Deny ID="ID_DENY_D_0045" FilePath="%OSDRIVE%\Program Files\Qianxin\Tianqing\*" />
    <Deny ID="ID_DENY_D_0046" FilePath="%OSDRIVE%\Program Files\Qualys*" />
    <Deny ID="ID_DENY_D_0047" FilePath="%OSDRIVE%\Program Files\Rising\REC\*" />
    <Deny ID="ID_DENY_D_0048" FilePath="%OSDRIVE%\Program Files\Sangfor\*" />
    <Deny ID="ID_DENY_D_0049" FilePath="%OSDRIVE%\Program Files\SentinelOne*" />
    <Deny ID="ID_DENY_D_004A" FilePath="%OSDRIVE%\Program Files\Sophos*" />
    <Deny ID="ID_DENY_D_004B" FilePath="%OSDRIVE%\Program Files\Tencent\QQPCMgr\*" />
    <Deny ID="ID_DENY_D_004C" FilePath="%OSDRIVE%\Program Files\Tianqing\*" />
    <Deny ID="ID_DENY_D_004D" FilePath="%OSDRIVE%\Program Files\Topsec\ESEndpoint\bin\*" />
    <Deny ID="ID_DENY_D_004E" FilePath="%OSDRIVE%\Program Files\Trend Micro*" />
    <Deny ID="ID_DENY_D_004F" FilePath="*\2345Associate.exe" />
    <Deny ID="ID_DENY_D_0050" FilePath="*\2345MPCSafe.exe" />
    <Deny ID="ID_DENY_D_0051" FilePath="*\2345RTProtect.exe" />
    <Deny ID="ID_DENY_D_0052" FilePath="*\2345SafeCenterInstaller.exe" />
    <Deny ID="ID_DENY_D_0053" FilePath="*\2345SafeCenterSvc.exe" />
    <Deny ID="ID_DENY_D_0054" FilePath="*\2345SafeCenterUpdate.exe" />
    <Deny ID="ID_DENY_D_0055" FilePath="*\2345SafeSvc.exe" />
    <Deny ID="ID_DENY_D_0056" FilePath="*\2345SafeTray.exe" />
    <Deny ID="ID_DENY_D_0057" FilePath="*\2345SafeUpdate.exe" />
    <Deny ID="ID_DENY_D_0058" FilePath="*\2345UsbGuard.exe" />
    <Deny ID="ID_DENY_D_0059" FilePath="*\2345VirusScan.exe" />
    <Deny ID="ID_DENY_D_005A" FilePath="*\360hips.exe" />
    <Deny ID="ID_DENY_D_005B" FilePath="*\360leakfixer.exe" />
    <Deny ID="ID_DENY_D_005C" FilePath="*\360rp.exe" />
    <Deny ID="ID_DENY_D_005D" FilePath="*\360rps.exe" />
    <Deny ID="ID_DENY_D_005E" FilePath="*\360Safe.exe" />
    <Deny ID="ID_DENY_D_005F" FilePath="*\360sd.exe" />
    <Deny ID="ID_DENY_D_0060" FilePath="*\360sdupd.exe" />
    <Deny ID="ID_DENY_D_0061" FilePath="*\360Tray.exe" />
    <Deny ID="ID_DENY_D_0062" FilePath="*\360Win7Shield.exe" />
    <Deny ID="ID_DENY_D_0063" FilePath="*\ConfigSecurityPolicy.exe" />
    <Deny ID="ID_DENY_D_0064" FilePath="*\HipsDaemon.exe" />
    <Deny ID="ID_DENY_D_0065" FilePath="*\HipsMain.exe" />
    <Deny ID="ID_DENY_D_0066" FilePath="*\HipsTray.exe" />
    <Deny ID="ID_DENY_D_0067" FilePath="*\HRUpdate.exe" />
    <Deny ID="ID_DENY_D_0068" FilePath="*\kdiskcleanup.exe" />
    <Deny ID="ID_DENY_D_0069" FilePath="*\kintercept.exe" />
    <Deny ID="ID_DENY_D_006A" FilePath="*\kislive.exe" />
    <Deny ID="ID_DENY_D_006B" FilePath="*\knewvip.exe" />
    <Deny ID="ID_DENY_D_006C" FilePath="*\kscan.exe" />
    <Deny ID="ID_DENY_D_006D" FilePath="*\ksearchservice.exe" />
    <Deny ID="ID_DENY_D_006E" FilePath="*\kwsprotect64.exe" />
    <Deny ID="ID_DENY_D_006F" FilePath="*\kxecenter.exe" />
    <Deny ID="ID_DENY_D_0070" FilePath="*\kxemain.exe" />
    <Deny ID="ID_DENY_D_0071" FilePath="*\kxescore.exe" />
    <Deny ID="ID_DENY_D_0072" FilePath="*\kxetray.exe" />
    <Deny ID="ID_DENY_D_0073" FilePath="*\kxewsc.exe" />
    <Deny ID="ID_DENY_D_0074" FilePath="*\LAVService.exe" />
    <Deny ID="ID_DENY_D_0075" FilePath="*\LenovoPcManager.exe" />
    <Deny ID="ID_DENY_D_0076" FilePath="*\LenovoPcManagerService.exe" />
    <Deny ID="ID_DENY_D_0077" FilePath="*\LenovoPCMKeyService.exe" />
    <Deny ID="ID_DENY_D_0078" FilePath="*\LenovoTray.exe" />
    <Deny ID="ID_DENY_D_0079" FilePath="*\LiveUpdate360.exe" />
    <Deny ID="ID_DENY_D_007A" FilePath="*\LnvSvcFdn.exe" />
    <Deny ID="ID_DENY_D_007B" FilePath="*\MalwareDetector.exe" />
    <Deny ID="ID_DENY_D_007C" FilePath="*\MpCmdRun.exe" />
    <Deny ID="ID_DENY_D_007D" FilePath="*\MpDefenderCoreService.exe" />
    <Deny ID="ID_DENY_D_007E" FilePath="*\MsMpEng.exe" />
    <Deny ID="ID_DENY_D_007F" FilePath="*\NisSrv.exe" />
    <Deny ID="ID_DENY_D_0080" FilePath="*\QMFileSmashHelper64.exe" />
    <Deny ID="ID_DENY_D_0081" FilePath="*\QMProviderUpdate.exe" />
    <Deny ID="ID_DENY_D_0082" FilePath="*\QQPCExternal.exe" />
    <Deny ID="ID_DENY_D_0083" FilePath="*\QQPCMgrUpdate.exe" />
    <Deny ID="ID_DENY_D_0084" FilePath="*\QQPCPatch.exe" />
    <Deny ID="ID_DENY_D_0085" FilePath="*\QQPCRTP.exe" />
    <Deny ID="ID_DENY_D_0086" FilePath="*\QQPCTray.exe" />
    <Deny ID="ID_DENY_D_0087" FilePath="*\QQPCUpdateAVLib.exe" />
    <Deny ID="ID_DENY_D_0088" FilePath="*\QQRepair.exe" />
    <Deny ID="ID_DENY_D_0089" FilePath="*\usysdiag.exe" />
    <Deny ID="ID_DENY_D_008A" FilePath="*\wsctrl10.exe" />
    <Deny ID="ID_DENY_D_008B" FilePath="*\wsctrl11.exe" />
    <Deny ID="ID_DENY_D_008C" FilePath="*\wsctrlsvc.exe" />
    <Deny ID="ID_DENY_D_008D" FilePath="*\ZhuDongFangYu.exe" />

Shake2333

mcafee kill

hashcake

brewtotal.pages.dev/reports/cmolatako3ak6s19cdrih9qef

xjwtzq

奇安信kill

吃瓜群众第123位

SEP Scan kill 入库杀

DeepSeek

满满的恶意行为：
1. 联网下载恶意载荷到Public目录
2. 通过\\localhost\pipe\atsvc创建计划，绕过EDR攻击链分析
3. 通过计划任务启动白加黑进程
4. 通过直接系统调用重复加载ntdll
5. 内存解密shellcode执行
6. 漏洞驱动利用
7. 修改WDAC策略Sipolicy.p7b
8. 创建cmd的计划任务去添加微软杀毒排除列表
9. 注入到svchos进程
10 银狐木马上线，C2是 15.197.148.33:9000 和 103.156.25.26:9000
...
后面没看了，太多行为了

c199529

腾讯电脑管家18

---------------------
2026-5-1 22:30:22 MD5:75276b8c8723c99a5817d3a4116fee29
银狐木马勿运行_Chrome_inst_6.5.1_x64.zip\Inst.5322e53201.exe [Win32.Trojan.FalseSign.Xtjl]
---------------------