Stealer 47x

xiaozhu009

https://qfile.qq.com/q/fJWpNofdvy
https://pan.huang1111.cn/s/75NOBfg

莒县小哥

卡巴杀41枚

anxiety520

BD
扫描

1. C:\Users\57\Desktop\20260725Stealer 47x\XONE_unpacked.exe Gen:Variant.Tedy.925123 已刪除
   
2. C:\Users\57\Desktop\20260725Stealer 47x\0e93f201f380868893fc4305abaa26fe6544737f5741769b07e5dd79d78b12a7.js=>(INFECTED_JS) GT:JS.Acsogenixx.4768.8050FD6C 已刪除
   
3. C:\Users\57\Desktop\20260725Stealer 47x\hideinseek.exe=>( UnpackX ) Trojan.LummaStealer.103 已刪除
   
4. C:\Users\57\Desktop\20260725Stealer 47x\AppVIsvSubsystems64.dll Gen:Variant.ShellcodeRunner.45 已刪除
   
5. C:\Users\57\Desktop\20260725Stealer 47x\Traceless.exe Gen:Variant.Application.Cerbu.76486 已刪除
   
6. C:\Users\57\Desktop\20260725Stealer 47x\ws-Setup-Complete.exe Trojan.GenericKD.80909178 已刪除
   
7. C:\Users\57\Desktop\20260725Stealer 47x\TEKLİF İSTEĞİ H…PO. A9832769 072026 URK75BSİl_xlsx.js=>(INFECTED_JS) JS:Trojan.Cryxos.16417 已刪除
   
8. C:\Users\57\Desktop\20260725Stealer 47x\UmbrellaLoaderLAST.exe Gen:Variant.Trojan.Ransomware.2040 已刪除
   
9. C:\Users\57\Desktop\20260725Stealer 47x\spearmacro.jar Trojan.GenericKD.80925304 已刪除
   
10. C:\Users\57\Desktop\20260725Stealer 47x\test4proof.exe=>( UnpackX ) Trojan.LummaStealer.103 已刪除
    
11. C:\Users\57\Desktop\20260725Stealer 47x\Snakekey logger.exe Trojan.GenericKD.80886260 已刪除
    
12. C:\Users\57\Desktop\20260725Stealer 47x\Quotation_Request_1162413.js=>(INFECTED_JS) GT:JS.AgentTesla.666.E778D9DE 已刪除
    
13. C:\Users\57\Desktop\20260725Stealer 47x\SKM 571043800.js Trojan.GenericKD.80928542 已刪除
    
14. C:\Users\57\Desktop\20260725Stealer 47x\really crack.exe IL:Trojan.Kryptik.224 已刪除
    
15. C:\Users\57\Desktop\20260725Stealer 47x\USDT Flasher.exe Dump:Generic.Shellcode.Loader.Marte.X.DA987567 已刪除
    
16. C:\Users\57\Desktop\20260725Stealer 47x\DHL booking format.js Trojan.GenericKD.80750278 已刪除
    
17. C:\Users\57\Desktop\20260725Stealer 47x\Xeno-v1.3.55.exe QD:Trojan.GenericKDQ.4551A91461 已刪除
    
18. C:\Users\57\Desktop\20260725Stealer 47x\mingwm10.dll Gen:Variant.GenericFCA.Tedy.73 已刪除
    
19. C:\Users\57\Desktop\20260725Stealer 47x\payload.exe Trojan.GenericKDZ.119174 已刪除
    
20. C:\Users\57\Desktop\20260725Stealer 47x\Order-Specification.pdf.js=>(INFECTED_JS) GT:JS.Acsogenixx.2784.E6063617 已刪除
    
21. C:\Users\57\Desktop\20260725Stealer 47x\a2466f14f61112db_RMS13JLYD.exe Trojan.GenericKD.80802390 已刪除
    
22. C:\Users\57\Desktop\20260725Stealer 47x\Kzqjxnoga.exe Gen:Variant.Zusy.606702 已刪除
    
23. C:\Users\57\Desktop\20260725Stealer 47x\COTIZACIÓN.js=>(INFECTED_JS) JS:Trojan.Cryxos.16518 已刪除
    
24. C:\Users\57\Desktop\20260725Stealer 47x\amidone . xyz.exe=>( UnpackX ) Trojan.LummaStealer.103 已刪除
    
25. C:\Users\57\Desktop\20260725Stealer 47x\Justificante banc.exe Trojan.GenericKD.80916055 已刪除
    
26. C:\Users\57\Desktop\20260725Stealer 47x\remu_stealer_process_tree.exe Trojan.GenericKDS.61549346 已刪除

复制代码

双击
65841178    Gen:Variant.Adware.Ulise.124631
Bootsexec64    missed
CAIXA_FACTURA0247_pdf99100 (2)    SuspiciousBehavior.760D137E6E1085D8
CAIXA_FACTURA0247_pdf99100   

1. C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 被傳遞了惡意命令列並已被封鎖

复制代码

ChilloutVrMod  SuspiciousBehavior.760D137E1DAE58DE

1. C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 被傳遞了惡意命令列並已被封鎖

复制代码

Cyneris Bot    missed
instaIIer-x64    杀衍生物

1. C:\ProgramData\MediumAquaMarineLightGreen\is-YV2Y61XI6Q.tmp 已偵測為感染 Trojan.GenericKD.80891041

复制代码

javaw    missed
pago_5728    杀衍生物
PinkyCraft_Launcher    missed
RE-CONFIRM    报错
Setup (2)    Gen:Variant.Ulise.605260
Setup    SuspiciousBehavior.760D137E444FD9BA
（衍生物payload    Gen:Variant.Vidar.82）
software_package_pkg_01    Gen:Variant.Stealer.565
SweetClient    SuspiciousBehavior.760D137E134DED06
Tender _70059520260723   

1. VBScript 試圖載入偵測為 Generic.PWSH.Downloader.D.97CECEE3 並被封鎖的惡意資源

复制代码

VеlоstrарреrХ128-v.7.868    Gen:Variant.Vidar.82
KawaiiLauncher Setup    杀衍生物

1. C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 被傳遞了惡意命令列並已被封鎖

复制代码

launcher    missed

123456aaaafsdeg

星河大帝

TES 扫描25x 双击仅Bootsexec64    missed
个别几个杀了本体 其他都被漏洞防护阻止powershell运行

Error50X

ESU初次扫描36X，二次扫描信誉杀增3X。

Myrenaser

EES解压剩余 x7

C:\Users\Administrator\Desktop\javaw.exe：MSIL/CaptureScreen.A potentially unsafe application
C:\Users\Administrator\Desktop\0e93f201f380868893fc4305abaa26fe6544737f5741769b07e5dd79d78b12a7.js: JS/TrojanDownloader.Agent.ADYG trojan
C:\Users\Administrator\Desktop\a2466f14f61112db_RMS13JLYD.exe: A variant of WinGo/Kryptik.UW trojan
C:\Users\Administrator\Desktop\65841178.exe: A variant of Generik.CIOURBZ trojan
C:\Users\Administrator\Desktop\amidone . xyz.exe: A variant of WinGo/Agent.AXZ trojan
C:\Users\Administrator\Desktop\AppVIsvSubsystems64.dll: A variant of Win64/TrojanDropper.Agent.AAF trojan
C:\Users\Administrator\Desktop\CAIXA_FACTURA0247_pdf99100 (2).js: JS/TrojanDownloader.Agent.AESE trojan
C:\Users\Administrator\Desktop\CAIXA_FACTURA0247_pdf99100.js: JS/TrojanDownloader.Agent.AESE trojan
C:\Users\Administrator\Desktop\COTIZACIÓN.js: JS/Kryptik.CZK trojan
C:\Users\Administrator\Desktop\DHL booking format.js: JS/Packed.Agent.AA suspicious application
C:\Users\Administrator\Desktop\instaIIer-x64.exe: Suspicious Object
C:\Users\Administrator\Desktop\hideinseek.exe: A variant of WinGo/Agent_AGen.XS trojan
C:\Users\Administrator\Desktop\Justificante banc.exe: NSIS/Injector.ASH trojan
C:\Users\Administrator\Desktop\Kzqjxnoga.exe: A variant of MSIL/Kryptik.AQCC trojan
C:\Users\Administrator\Desktop\mingwm10.dll: Suspicious Object
C:\Users\Administrator\Desktop\mpclient (2).dll: A variant of Win64/GenKryptik.HRGN trojan
C:\Users\Administrator\Desktop\mpclient.dll: A variant of Win64/GenKryptik.HRGN trojan
C:\Users\Administrator\Desktop\pago_5728.js: A variant of Generik.BXUHLWV trojan
C:\Users\Administrator\Desktop\Order-Specification.pdf.js: JS/Agent.UED trojan
C:\Users\Administrator\Desktop\Quotation_Request_1162413.js: MSIL/Spy.SnakeStealer.A trojan
C:\Users\Administrator\Desktop\RE-CONFIRM.vbs: VBS/Agent.UEG trojan
C:\Users\Administrator\Desktop\Tender _70059520260723.vbs: VBS/Agent.UEG trojan

Myrenaser

Myrenaser 发表于 2026-7-25 13:43
EES解压剩余 x7

C:%users\Administrator\Desktop\javaw.exe：MSIL/CaptureScreen.A potentially unsafe  ...

有显示错误，以下的没有显示5号且为标红的字体，所以这里单独发：
C:\Users\Administrator\Desktop\payload.exe: A variant of WinGo/Kryptik.VS trojan
C:\Users\Administrator\Desktop\SKM 571043800.js: PowerShell/Kryptik.LJ trojan
C:\Users\Administrator\Desktop\remu_stealer_process_tree.exe: A variant of WinGo/Kryptik.VP trojan
C:\Users\Administrator\Desktop\Setup (2).exe: A variant of Generik.KZFOEGB trojan
C:\Users\Administrator\Desktop\Snakekey logger.exe: A variant of MSIL/Injector.WVB trojan
C:\Users\Administrator\Desktop\software_package_pkg_01.exe: Multiple detections :
VBS/TrojanDownloader.Agent.ADMO trojan
A variant of Win64/Spy.Agent.AHB trojan
C:\Users\Administrator\Desktop\spearmacro.jar: Suspicious Object
C:\Users\Administrator\Desktop\SweetClient.exe: Suspicious Object
C:\Users\Administrator\Desktop\really crack.exe: ML/Augur trojan
C:\Users\Administrator\Desktop\test4proof.exe: A variant of WinGo/Agent_AGen.XS trojan
C:\Users\Administrator\Desktop\Traceless.exe: A variant of Win32/TrojanDropper.Agent.SRP trojan
C:\Users\Administrator\Desktop\UmbrellaLoaderLAST.exe: A variant of Generik.DZKKPRK trojan
C:\Users\Administrator\Desktop\VеlоstrарреrХ128-v.7.868.exe: Suspicious Object
C:\Users\Administrator\Desktop\ws-Setup-Complete.exe: A variant of WinGo/Kryptik.VL trojan
C:\Users\Administrator\Desktop\XONE_unpacked.exe: A variant of WinGo/Agent.VO trojan
C:\Users\Administrator\Desktop\Xeno-v1.3.55.exe: Suspicious Object
C:\Users\Administrator\Desktop\USDT Flasher.exe: A variant of Win64/GenKryptik.HTCA trojan

xjwtzq

奇安信扫描37

fdsax

emsi 扫描26x，双击13x，剩余9x

1. 0   C:\Users\ADMINI~1\AppData\Local\Temp\tmp_wMdgDr3F7z3pFB\JSSSDxWdX0.exe 发现风险： Behavior.Spyware
   
2. 1   C:\Users\ADMINI~1\AppData\Local\Temp\tmp_xrdmwZUcYTFiWC\xrdmwZUcYT.exe 发现风险： Behavior.Spyware
   
3. 2   C:\Users\Administrator\AppData\Local\Programs\PinkyCraft Launcher\PinkyCraft Launcher.exe 发现风险： Behavior.AutorunCreation
   
4. 3   C:\Users\Administrator\Desktop\20260725Stealer 47x\0e93f201f380868893fc4305abaa26fe6544737f5741769b07e5dd79d78b12a7.js 发现风险： GT:JS.Acsogenixx.4768.8050FD6C (B)
   
5. 4   C:\Users\Administrator\Desktop\20260725Stealer 47x\65841178.exe 发现风险： 云端信誉不良
   
6. 5   C:\Users\Administrator\Desktop\20260725Stealer 47x\a2466f14f61112db_RMS13JLYD.exe 发现风险： Trojan.GenericKD.80802390 (B)
   
7. 6   C:\Users\Administrator\Desktop\20260725Stealer 47x\amidone . xyz.exe 发现风险： Trojan.LummaStealer.103 (B)
   
8. 7   C:\Users\Administrator\Desktop\20260725Stealer 47x\AppVIsvSubsystems64.dll 发现风险： Gen:Variant.ShellcodeRunner.45 (B)
   
9. 8   C:\Users\Administrator\Desktop\20260725Stealer 47x\Bootsexec64.exe 发现风险： Behavior.Spyware
   
10. 9   C:\Users\Administrator\Desktop\20260725Stealer 47x\ChilloutVrMod.exe 发现风险： Behavior.CryptoMalware
    
11. 10  C:\Users\Administrator\Desktop\20260725Stealer 47x\COTIZACIÓN.js 发现风险： JS:Trojan.Cryxos.16518 (B)
    
12. 11  C:\Users\Administrator\Desktop\20260725Stealer 47x\DHL booking format.js 发现风险： Trojan.GenericKD.80750278 (B)
    
13. 12  C:\Users\Administrator\Desktop\20260725Stealer 47x\hideinseek.exe 发现风险： Trojan.LummaStealer.103 (B)
    
14. 13  C:\Users\Administrator\Desktop\20260725Stealer 47x\javaw.exe 发现风险： 云端信誉不良
    
15. 14  C:\Users\Administrator\Desktop\20260725Stealer 47x\Justificante banc.exe 发现风险： Trojan.GenericKD.80916055 (B)
    
16. 15  C:\Users\Administrator\Desktop\20260725Stealer 47x\Kzqjxnoga.exe 发现风险： Gen:Variant.Zusy.606702 (B)
    
17. 16  C:\Users\Administrator\Desktop\20260725Stealer 47x\mingwm10.dll 发现风险： Gen:Variant.GenericFCA.Tedy.73 (B)
    
18. 17  C:\Users\Administrator\Desktop\20260725Stealer 47x\Order-Specification.pdf.js 发现风险： GT:JS.Acsogenixx.2784.E6063617 (B)
    
19. 18  C:\Users\Administrator\Desktop\20260725Stealer 47x\payload.exe 发现风险： Trojan.GenericKDZ.119174 (B)
    
20. 19  C:\Users\Administrator\Desktop\20260725Stealer 47x\Quotation_Request_1162413.js 发现风险： GT:JS.AgentTesla.666.E778D9DE (B)
    
21. 20  C:\Users\Administrator\Desktop\20260725Stealer 47x\really crack.exe 发现风险： IL:Trojan.Kryptik.224 (B)
    
22. 21  C:\Users\Administrator\Desktop\20260725Stealer 47x\remu_stealer_process_tree.exe 发现风险： Trojan.GenericKDS.61549346 (B)
    
23. 22  C:\Users\Administrator\Desktop\20260725Stealer 47x\Setup (2).exe 发现风险： 云端信誉不良
    
24. 23  C:\Users\Administrator\Desktop\20260725Stealer 47x\Setup.exe 发现风险： 云端信誉不良
    
25. 24  C:\Users\Administrator\Desktop\20260725Stealer 47x\SKM 571043800.js 发现风险： Trojan.GenericKD.80928542 (B)
    
26. 25  C:\Users\Administrator\Desktop\20260725Stealer 47x\Snakekey logger.exe 发现风险： Trojan.GenericKD.80886260 (B)
    
27. 26  C:\Users\Administrator\Desktop\20260725Stealer 47x\spearmacro.jar 发现风险： Trojan.GenericKD.80925304 (B)
    
28. 27  C:\Users\Administrator\Desktop\20260725Stealer 47x\SweetClient.exe 发现风险： 云端信誉不良
    
29. 28  C:\Users\Administrator\Desktop\20260725Stealer 47x\TEKLİF İSTEĞİ H…PO. A9832769 072026 URK75BSİl_xlsx.js 发现风险： JS:Trojan.Cryxos.16417 (B)
    
30. 29  C:\Users\Administrator\Desktop\20260725Stealer 47x\test4proof.exe 发现风险： Trojan.LummaStealer.103 (B)
    
31. 30  C:\Users\Administrator\Desktop\20260725Stealer 47x\Traceless.exe 发现风险： Gen:Variant.Application.Cerbu.76486 (B)
    
32. 31  C:\Users\Administrator\Desktop\20260725Stealer 47x\UmbrellaLoaderLAST.exe 发现风险： Gen:Variant.Trojan.Ransomware.2040 (B)
    
33. 32  C:\Users\Administrator\Desktop\20260725Stealer 47x\USDT Flasher.exe 发现风险： Dump:Generic.Shellcode.Loader.Marte.X.DA987567 (B)
    
34. 33  C:\Users\Administrator\Desktop\20260725Stealer 47x\VеlоstrарреrХ128-v.7.868.exe 发现风险： 云端信誉不良
    
35. 34  C:\Users\Administrator\Desktop\20260725Stealer 47x\ws-Setup-Complete.exe 发现风险： Trojan.GenericKD.80909178 (B)
    
36. 35  C:\Users\Administrator\Desktop\20260725Stealer 47x\Xeno-v1.3.55.exe 发现风险： QD:Trojan.GenericKDQ.4551A91461 (B)
    
37. 36  C:\Users\Administrator\Desktop\20260725Stealer 47x\XONE_unpacked.exe 发现风险： Gen:Variant.Tedy.925123 (B)

复制代码