#Confirmed(2/2) #Silverfox #RAT

pal家族

啊松 发表于 2026-6-19 22:11
卡巴的最新病毒库貌似可以阻止加驱，但是没法阻止启动项

确实在我双击之后过了大概半小时有一次主防特征库升级，但肯定跟我的上报没关系了。

后面·我再玩双击就一律开trace。
有问题就连样本带trace一起上报更有说服力。

pal家族

jli.dll - Trojan.Win64.Aotnet.b

We are conducting further research into the behavioral detection of this malware. We will contact you as soon as we receive the results.
Best regards, Danila, Malware Analyst

DisaPDB

pal家族 发表于 2026-6-19 22:34
We are conducting further research into the behavioral detection of this malware. We will contact yo ...

屏幕截图的函数：

1. int *__fastcall sub_407C90(int *a1, int *a2, unsigned int *a3)
   
2. {
   
3.   HWND DesktopWindow; // eax
   
4.   HDC DC; // esi
   
5.   double v5; // st7
   
6.   unsigned int v6; // ebx
   
7.   unsigned int *v7; // eax
   
8.   unsigned int *v8; // esi
   
9.   int *v10; // eax
   
10.   unsigned int *v11; // ecx
    
11.   int v12; // [esp-8h] [ebp-84h]
    
12.   int v13; // [esp+Ch] [ebp-70h]
    
13.   int v14; // [esp+10h] [ebp-6Ch]
    
14.   int ySrc; // [esp+18h] [ebp-64h]
    
15.   _BYTE v17[12]; // [esp+1Ch] [ebp-60h] BYREF
    
16.   int xSrc; // [esp+30h] [ebp-4Ch]
    
17.   int *v19; // [esp+34h] [ebp-48h]
    
18.   HDC hdc; // [esp+38h] [ebp-44h]
    
19.   HBITMAP hbm; // [esp+3Ch] [ebp-40h]
    
20.   HDC hdcDest; // [esp+40h] [ebp-3Ch]
    
21.   LPVOID lpvBits; // [esp+44h] [ebp-38h]
    
22.   tagBITMAPINFO bmi; // [esp+4Ch] [ebp-30h] BYREF
    
23. 
    
24.   v19 = a2;
    
25.   DesktopWindow = GetDesktopWindow();
    
26.   hdc = GetDC(DesktopWindow);
    
27.   hdcDest = CreateCompatibleDC(hdc);
    
28.   DC = GetDC(0);
    
29.   hbm = (HBITMAP)GetDeviceCaps(DC, 8);
    
30.   *(float *)&lpvBits = (double)GetDeviceCaps(DC, 118) / (double)(int)hbm;
    
31.   ReleaseDC(0, DC);
    
32.   v14 = (int)((double)GetSystemMetrics(78) * *(float *)&lpvBits);
    
33.   v13 = (int)((double)GetSystemMetrics(79) * *(float *)&lpvBits);
    
34.   xSrc = (int)((double)GetSystemMetrics(76) * *(float *)&lpvBits);
    
35.   ySrc = (int)((double)GetSystemMetrics(77) * *(float *)&lpvBits);
    
36.   hbm = CreateCompatibleBitmap(hdc, v14, v13);
    
37.   SelectObject(hdcDest, hbm);
    
38.   SetStretchBltMode(hdcDest, 3);
    
39.   v12 = (int)((double)GetSystemMetrics(79) * *(float *)&lpvBits);
    
40.   v5 = (double)GetSystemMetrics(78) * *(float *)&lpvBits;
    
41.   StretchBlt(hdcDest, 0, 0, v14, v13, hdc, xSrc, ySrc, (int)v5, v12, 0xCC0020u);
    
42.   bmi.bmiHeader.biWidth = v14;
    
43.   v6 = 4 * v13 * ((32 * v14 + 31) / 32);
    
44.   memset(&bmi.bmiHeader.biCompression, 0, 24);
    
45.   bmi.bmiHeader.biSize = 40;
    
46.   bmi.bmiHeader.biHeight = v13;
    
47.   *(_DWORD *)&bmi.bmiHeader.biPlanes = 2097153;
    
48.   *(_QWORD *)&v17[2] = v6 + 54;
    
49.   *(_WORD *)v17 = 19778;
    
50.   strcpy(&v17[10], "6");
    
51.   *(float *)&lpvBits = COERCE_FLOAT(operator new[](v6));
    
52.   memset(lpvBits, 0, v6);
    
53.   GetDIBits(hdcDest, hbm, 0, v13, lpvBits, &bmi, 0);
    
54.   xSrc = (int)operator new[](v6 + 54);
    
55.   memset((void *)xSrc, 0, v6 + 54);
    
56.   *(_DWORD *)xSrc = *(_DWORD *)v17;
    
57.   *(_QWORD *)(xSrc + 4) = *(_QWORD *)&v17[4];
    
58.   *(_WORD *)(xSrc + 12) = 0;
    
59.   qmemcpy((void *)(xSrc + 14), &bmi, 0x28u);
    
60.   memcpy_0((void *)(xSrc + 54), lpvBits, v6);
    
61.   v7 = (unsigned int *)operator new(0x1Cu);
    
62.   v8 = 0;
    
63.   if ( v7 )
    
64.   {
    
65.     v7[4] = 0;
    
66.     v7[5] = 15;
    
67.     *(_BYTE *)v7 = 0;
    
68.     v8 = v7;
    
69.   }
    
70.   if ( sub_407A80(xSrc) )
    
71.   {
    
72.     *a3 = v8[4];
    
73.     *a1 = v14;
    
74.     *v19 = v13;
    
75.     v10 = (int *)operator new[](*a3);
    
76.     v19 = v10;
    
77.     if ( v8[5] < 0x10 )
    
78.       v11 = v8;
    
79.     else
    
80.       v11 = (unsigned int *)*v8;
    
81.     memcpy_0(v10, v11, *a3);
    
82.     DeleteObject(hbm);
    
83.     DeleteObject(hdcDest);
    
84.     ReleaseDC(0, hdc);
    
85.     operator delete[]((void *)xSrc);
    
86.     if ( *(float *)&lpvBits != 0.0 )
    
87.       operator delete[](lpvBits);
    
88.     if ( v8[5] >= 0x10 )
    
89.       operator delete((void *)*v8);
    
90.     v8[5] = 15;
    
91.     v8[4] = 0;
    
92.     *(_BYTE *)v8 = 0;
    
93.     operator delete(v8);
    
94.     return v19;
    
95.   }
    
96.   else
    
97.   {
    
98.     DeleteObject(hbm);
    
99.     DeleteObject(hdcDest);
    
100.     ReleaseDC(0, hdc);
     
101.     operator delete[]((void *)xSrc);
     
102.     if ( *(float *)&lpvBits != 0.0 )
     
103.       operator delete[](lpvBits);
     
104.     if ( v8 )
     
105.     {
     
106.       if ( v8[5] >= 0x10 )
     
107.         operator delete((void *)*v8);
     
108.       v8[5] = 15;
     
109.       v8[4] = 0;
     
110.       *(_BYTE *)v8 = 0;
     
111.       operator delete(v8);
     
112.     }
     
113.     return 0;
     
114.   }
     
115. }

复制代码

调用Windows GDI截的图

wwwab

火绒有实力的：

pal家族

DisaPDB 发表于 2026-6-19 22:40
屏幕截图的函数：

你们都是真大佬、

我是小卡拉米 能做一点微末的贡献

GDHJDSYDH

红伞 kill dll，沙盒内运行拦截加驱+HMPA kill

心醉咖啡

金山毒霸扫描miss

lsop1349987

Tax-Number219863.exe断网测试 非最新病毒库
avast被秒 阻止漏洞驱动选项依旧摆设
Avira杀dll
webroot 提示加驱和启动项（联网下不杀，似乎没干死，且可重新打开）
hmpa 杀，报法同上，且安全中心没死

idhaname

BD断网双击，病毒库为6月18日

星河大帝

TES kill dll 无截图行为