zhujiabao050624

[zhujiabao050624 @BAO0624]

@smica83 @suyog41 Thx

[zhujiabao050624 @BAO0624]

@skocherhan @smica83 @malwrhunterteam @tdatwja @JaffaCakes118 @JAMESWT_WT @James_inthe_box @SquiblydooBlog @byrne_emmy12099

[zhujiabao050624 @BAO0624]

A suspected MustangPanda APT backdoor disguised as PDF software.

Sample shared for further malware analysis.

dll：https://t.co/YMrpBwRsRa

anyrun分析：https://t.co/kJMCkmmk0D

#MustangPanda #APT #Backdoor #MalwareAnalysis

[zhujiabao050624 @BAO0624]

A Silver Fox Trojan disguised as tax-related software has been discovered.

Sharing this sample for further malware analysis.

有问题的dll: 7e5a0b1adaff5071f4b2fb252502eb96
#SilverFox
@malwrhunterteam @tdatwja @JAMESWT_WT @joe4security @JaffaCakes118 @skocherhan @smica83

[zhujiabao050624 @BAO0624]

@smica83 @skocherhan @malwrhunterteam @tdatwja #rookit #silverfox #valleyrat

[zhujiabao050624 @BAO0624]

A vulnerable driver dropped by Silver Fox, seemingly designed to disable security products by abusing kernel-level privileges.
During my analysis, it successfully terminated Huorong Security.
md5：19e4b21665ccdd0286877992cf909bb2
@smica83 @skocherhan @malwrhunterteam @tdatwja

[zhujiabao050624 @BAO0624]

@smica83 @skocherhan @malwrhunterteam @tdatwja 这个是银狐的sha256：a2344069ef3c26680156fd507ed36f4060b692e8a401d9d04335055c854f0d2d

[zhujiabao050624 @BAO0624]

@byrne_emmy12099 这个lnk的命名得是Membership_Offer.pdf.lnk才会成功执行....

[zhujiabao050624 @BAO0624]

@tdatwja @skocherhan This strikes me as an unreasonable decision from VirusTotal.

[zhujiabao050624 @BAO0624]

@virustotal @plusvic @bquintero @VirusTotal Why are you ignoring this? My account was suspended, my contributions disappeared, and my appeals were ignored. Is this how @VirusTotal treats its contributors? I demand answers, not silence.

[zhujiabao050624 @BAO0624]

@VirusTotal My account was suspended, my contributions disappeared, and my appeals went unanswered. Security researchers deserve transparency and fair treatment. Please explain this decision and review my case.

#VirusTotal #CyberSecurity

[zhujiabao050624 @BAO0624]

@plusvic @VirusTotal suspended my account, my contributions disappeared, and nobody has answered my appeals. This is unacceptable. I demand transparency, an explanation for this decision, and a fair review of my case. How long must I wait for a response? my VT name is zhuzhu009

[zhujiabao050624 @BAO0624]

@virustotal @VirusTotal suspended my account, my contributions disappeared, and nobody has answered my appeals. This is unacceptable. I demand transparency, an explanation for this decision, and a fair review of my case. How long must I wait for a response? MY VT name is zhuzhu009 😠😠

[zhujiabao050624 @BAO0624]

@bquintero @VirusTotal suspended my account, my contributions disappeared, and nobody has answered my appeals. This is unacceptable. I demand transparency, an explanation for this decision, and a fair review of my case. How long must I wait for a response?

[zhujiabao050624 @BAO0624]

@virustotal @tdatwja @masaomi346 @skocherhan My VT name is zhuzhu009 .Could you please repost this and help me get @VirusTotal's attention? Your support would mean a lot to me. Thank you!

[zhujiabao050624 @BAO0624]

@masaomi346 无障碍病毒

[zhujiabao050624 @BAO0624]

@masaomi346 @tdatwja @skocherhan @JAMESWT_WT

[zhujiabao050624 @BAO0624]

@masaomi346 This looks like another malware sample that abuses Accessibility Services. The malicious app shown below configures itself to exit automatically once launched, preventing users from uninstalling it.

图片2是它自己设置的过程

[zhujiabao050624 @BAO0624]

@tdatwja 这个VT的链接好像是正常的WPS，看看是不是有什么隐藏文件呢