疑似具有虚拟机逃逸 Windows.lnk ，TrojanDownloader/LNK.Agent.ie，火绒衍生物不杀

scottxzt

3306-1 发表于 2026-9-13 10:17
样本在昨晚１１点更新，加入了相对完整衍生物，大佬方便复测吗

Trojan:Win32/Sabsik.EN.A!ml

file: F:\Windows zljll\Windows zljll.exe

fdsax

emsi双击

c199529

腾讯电脑管家18

---------------------
2026-9-14 01:00:06 MD5:004ceddbef36b0d171e134a81b8099ee Windows zljll\Windows zljll.exe [Win32.Trojan.Powecod.Uwhl]  [未修复]
2026-9-14 01:00:06 MD5:d2b7535662dc3def9cf7258c0c55c838 Windows zljll\Windows zljll\Windows.exe [Win32.Trojan.Powecod.Rgil]  [未修复]
2026-9-14 01:00:06 MD5:37125a078c8d418271e829ba565b1787 Windows zljll\Windows zljll\LoggerCollector.dll [Win32.Trojan.Generic.Wimw]  [未修复]
2026-9-14 01:00:06 MD5:b260a6e08b05a00cc7b7797b6bc5fb26 Windows zljll\Windows zljll\gmodule-2.0.dll [Win32.Trojan.Generic.Nqil]  [未修复]
2026-9-14 01:00:06 MD5:5ecf451f600571e4dbe506bccc8d4e48 Windows zljll\Windows zljll\stage2.bin [Win32.Trojan.Scod.Adhl]  [未修复]
---------------------

WGC_ZY

ESSP：C:\Users\Zhang\Downloads\Windows zljll\Windows zljll.exe;multiple detections;deleted;Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe (130D6B728BA6F4B129C84CD3A6EE0B71A11219F813C4DF181FB6823FFBA7F484).;2DE286380AE7740EA882BCB12E8C8BF2BC8C24E3CAD117CEE7458009E888D79C;9/15/2026 1:30:36 PM