Stealer 5x

xiaozhu009

https://qfile.qq.com/q/k1z3W7LAyW
https://pan.huang1111.cn/s/1Qbw5Tv

星河大帝

TES 扫描3x
双击 剩余1x但被自带规则阻止

xjwtzq

奇安信杀5

一只小白泽

avast 扫描杀3

ISAZre

卡巴清空

hashcake

TsAgent
静态漏32ebb3fb5d0345619290c4b0554ae1ff.exe
静态漏Order Specification.Pdf.js剩下的静态杀




动态测试:
最开始上面两个是基本没反应的
等了几分钟突然杀个白加黑，不知道是属于谁的
[mem] dump fail pid=1176 @0x7FF88C956000+4096: None
[mem] DumpMemory ioctl fail err=5
[mem] dump fail pid=1176 @0x7FF88C957000+4096: None
[mem] DumpMemory ioctl fail err=5
[mem] dump fail pid=1176 @0x7FF88C959000+4096: None
[mem] DumpMemory ioctl fail err=5
[mem] dump fail pid=1176 @0x7FF88C95B000+4096: None
[mem] DumpMemory ioctl fail err=5
[mem] dump fail pid=1176 @0x7FF88C421000+4096: None

ZkdaGV.exe(zx:0.25490013)(conv:0.45813859)(FML:0.16026068)(TEX:0.00001311) final:0.1257592280588762
[SCAN] PROC CLEAN pid=6096 C:\Program Files (x86)\ZkdaGV\ZkdaGV.exe score=0.1258

XPSPLOG.dll(zx:0.98843807)(conv:0.06639249)(FML:0.99978453)(TEX:0.99878865) final:0.9617354815674235
[SCAN] DLL MAL pid=6096 C:\Program Files (x86)\ZkdaGV\XPSPLOG.dll score=0.9617
程序:Ti Security Agent
标题:需要注意
内容:发现潜在恶意程序:XPSPLOG.dll (置信度 96.2%)
程序:Ti Security Agent
标题:需要注意
----------------------------------------
内容:发现潜在恶意程序:XPSPLOG.dll (置信度 96.2%) [去重]
----------------------------------------
打包... C:\ProgramData\TiSecurityAgent\Quarantine\XPSPLOG.dll.4a18b1098d63210d.7z,C:\Program Files (x86)\ZkdaGV\XPSPLOG.dll
[隔离] 已打包加密并删除源文件: C:\Program Files (x86)\ZkdaGV\XPSPLOG.dll -> C:\ProgramData\TiSecurityAgent\Quarantine\XPSPLOG.dll.4a18b1098d63210d.7z
程序:Ti Security Agent
标题:需要注意
内容:于 C:\Program Files (x86)\ZkdaGV\XPSPLOG.dll 中发现威胁。文件已隔离。
----------------------------------------
[mem] dump fail pid=3200 @0x7FF88C4D3000+4096: no-MZ
[mem] dump fail pid=3200 @0x7FF88C4D4000+4096: no-MZ

心醉咖啡

360

2015767342

BD 右键 3 kill

fdsax

emsi扫描2x，双击2x

1.    C:\Users\ADMINI~1\AppData\Local\Temp\dbs_PnIeFto8\DumpBrowserSecrets.exe 发现风险： Gen:Variant.Lazy.169284 (B)
   
2.    C:\Users\ADMINI~1\AppData\Local\Temp\h_iCBB9iAg.exe 发现风险： Behavior.HiddenInstallation
   
3.    C:\Users\ADMINI~1\AppData\Local\Temp\tmp_nYxcqLpzfYQitR\QfqG5TGLRx.exe 发现风险： Behavior.Spyware
   
4.    C:\Users\Administrator\Desktop\20260726Stealer 5x\32ebb3fb5d0345619290c4b0554ae1ff.exe 发现风险： Trojan.GenericKD.80941886 (B)
   
5.    C:\Users\Administrator\Desktop\20260726Stealer 5x\Setup.exe 发现风险： Trojan.GenericKD.80939786 (B)
   

复制代码

Myrenaser

EES解压 + 扫描清除

C:\Users\Administrator\Desktop\Windows_Update_Assistant.exe：A variant of Win64/Agent.KJB trojan
C:\Users\Administrator\Desktop\32ebb3fb5d0345619290c4b0554ae1ff.exe：A variant of Generik.EBSVZYF trojan
C:\Users\Administrator\Desktop\Order Specification.Pdf.js：JS/Packed.Agent.AA suspicious application
C:\Users\Administrator\Desktop\dd_Pkg_09_yrxp12x2.exe：VBS/TrojanDownloader.Agent.ADMO trojan
C:\Users\Administrator\Desktop\Setup.exe：A variant of WinGo/Kryptik.VU trojan